Read the docs
TI-2025-36897 Aliases CVE-2025-59335

CubeCart Session Not Invalidated After Password Change

Priority HIGH 66CWE-613Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed v6 (cubecart): 6.5.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cubecartv6before 6.5.116.5.11Patch availableCNA
  • v6 Vendorcubecart Affected before 6.5.11 Fixed in 6.5.11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:*before 6.5.11Vulnerablecubecart
  • cpe:2.3:a:cubecart:cubecart:*:*:*:*:*:*:*:* Versions before 6.5.11 Vulnerable ·cubecart

Remediation

  • Fix · CNA v6 (cubecart) Fixed in 6.5.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59335

References

Exploit 1

Patch 2

  • TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
  • TI-2025-36966 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVSS 3.1MEDIUM 6.5
  • TI-2025-36965 CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement CVSS 3.1MEDIUM 5.4
  • TI-2025-36964 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry CVSS 3.1MEDIUM 5.4
  • TI-2013-01273 The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through… CVSS 3.1CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences