CVE-2025-59413

CubeCart is an ecommerce software solution. Prior to version 6.5.11, a logic flaw exists in the newsletter subscription endpoint that allows an attacker to unsubscribe any user without their consent. By changing the value of the force_unsubscribe parameter in the POST request to 1, an attacker can force the removal of any valid subscriber’s email address. This issue has been patched in version 6.5.11.

• CWE-862

• https://github.com/cubecart/v6/commit/7fd1cd04f5d5c3ce1d7980327464f0ff6551de79Patch
• https://github.com/cubecart/v6/commit/db965fcfa260c4f17eb16f8c5494e5af4a8ac271Patch
• https://github.com/cubecart/v6/commit/dbc58cf1f7a6291f7add5893b56bff7920a29128Patch
• https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7fExploit, Vendor Advisory
• https://github.com/cubecart/v6/security/advisories/GHSA-869v-gjv8-9m7fExploit, Vendor Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59408Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_…7.3
• CVE-2025-59409Flock Safety Falcon and Sparrow License Plate Readers OPM1.1…7.5
• CVE-2025-5941Netskope is notified about a potential gap in its agent (NS …2
• CVE-2025-59410Dragonfly is an open source P2P-based file distribution and …3.7
• CVE-2025-59411CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59412CubeCart is an ecommerce software solution. Prior to version…5.4
• CVE-2025-59414Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2025-59415Frappe Learning is a learning system that helps users struct…5.4
• CVE-2025-59416The Scratch Channel is a news website. If the user makes a f…7.2
• CVE-2025-59417Lobe Chat is an open-source artificial intelligence chat fra…6.1
• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5
• CVE-2025-59419Netty is an asynchronous, event-driven network application f…5.5