Security Advisory

CVE-2025-59413

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-09-22 16:15:00

Last updated 2025-09-22 17:26:29

Assigner GitHub_M

State PUBLISHED

Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

← Browse all CVEs View on cve.org ↗