{"cve":"CVE-2025-59335","nvd":{"published":"2025-09-22T17:16:08.527","modified":"2026-06-17T09:45:55.713","status":"Analyzed","description":"CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":7.1},"cwes":["CWE-613"],"references":["https://github.com/cubecart/v6/commit/4bfaeb4485dd82255a108940a163af5ba4583b52","https://github.com/cubecart/v6/commit/62d9be8416aa6fd7343f8932d98c5b112b163e26","https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvv","https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvv"],"products":["cubecart:cubecart"],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-59335","score":0.00207,"percentile":0.10816,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}