CVE-2025-59413

{"id": "CVE-2025-59413", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-09-22T17:16:09.037", "references": [{"url": "https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7f", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber\u2019s email address. This issue has been patched in version 6.5.11."}], "lastModified": "2025-09-23T16:49:02.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE2B06FC-9BF4-4BAF-9B38-1FD7B55A766E", "versionEndExcluding": "6.5.11"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}