CVE-2025-59335

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.

• CWE-613

• https://github.com/cubecart/v6/commit/4bfaeb4485dd82255a108940a163af5ba4583b52Patch
• https://github.com/cubecart/v6/commit/62d9be8416aa6fd7343f8932d98c5b112b163e26Patch
• https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvvExploit, Vendor Advisory
• https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvvExploit, Vendor Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5933The RD Contacto plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2025-59330error-ex allows error subclassing and stack customization. O…8.8
• CVE-2025-59331is-arrayish checks if an object can be used like an Array. O…8.8
• CVE-2025-593323DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 t…8.6
• CVE-2025-59333The mcp-database-server (MCP Server) 1.1.0 and earlier, as d…8.1
• CVE-2025-59334Linkr is a lightweight file delivery system that downloads f…8.8
• CVE-2025-59336Luanox is a module host for Lua packages. Prior to 0.1.1, a …6.9
• CVE-2025-59337Discourse is an open-source community discussion platform. I…6.8
• CVE-2025-59339The Bastion provides authentication, authorization, traceabi…4.4
• CVE-2025-5934A vulnerability was found in Netgear EX3700 up to 1.0.0.88. …8.8
• CVE-2025-59340jinjava is a Java-based template engine based on django temp…10
• CVE-2025-59341esm.sh is a nobuild content delivery network(CDN) for modern…7.7