CVE-2025-59335: CubeCart Session Not Invalidated After Password Change

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-22 · updated 2026-06-17
Weakness: CWE-613

Description

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.

Affected products

CubeCart Limited CubeCart: before 6.5.11 — fixed in 6.5.11

How to fix

Upgrade to a fixed version: CubeCart Limited CubeCart 6.5.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59335 or the next vulnerability affects your stack