Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

INFO

Published Date :

2025-09-22T16:15:00.351Z

Last Modified :

2025-09-22T17:26:29.173Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-59413 vulnerability.

Vendors Products
Cubecart
  • Cubecart
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-59413.

URL Resource
https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79 cve-icon cve-icon
https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271 cve-icon cve-icon
https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128 cve-icon cve-icon
https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact