CVE-2025-50850: n/a
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.
AI Analysis
Technical Summary
CVE-2025-50850 describes a vulnerability in CS Cart 4.18.3 where the vendor login endpoint lacks essential protections such as CAPTCHA verification and rate limiting. This absence enables attackers to conduct automated brute-force attacks against vendor accounts, potentially gaining unauthorized access. The vulnerability is characterized by low attack complexity, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. No patch or official remediation information is provided in the source data.
Potential Impact
The vulnerability allows attackers to perform automated brute-force attacks on vendor login accounts, potentially leading to unauthorized access. This can compromise the confidentiality and integrity of vendor accounts and cause denial of service or disruption (high availability impact). There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, consider implementing external protections such as web application firewalls with rate limiting or CAPTCHA on the login endpoint to reduce brute-force attack risks.
CVE-2025-50850: n/a
Description
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.
CVSS v3.1
Score 8.6high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-50850 describes a vulnerability in CS Cart 4.18.3 where the vendor login endpoint lacks essential protections such as CAPTCHA verification and rate limiting. This absence enables attackers to conduct automated brute-force attacks against vendor accounts, potentially gaining unauthorized access. The vulnerability is characterized by low attack complexity, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. No patch or official remediation information is provided in the source data.
Potential Impact
The vulnerability allows attackers to perform automated brute-force attacks on vendor login accounts, potentially leading to unauthorized access. This can compromise the confidentiality and integrity of vendor accounts and cause denial of service or disruption (high availability impact). There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, consider implementing external protections such as web application firewalls with rate limiting or CAPTCHA on the login endpoint to reduce brute-force attack risks.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2025-06-16T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 688bcbf9ad5a09ad00bbffc2
Added to database: 07/31/2025, 20:03:05 UTC
Last enriched: 07/05/2026, 22:07:34 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 312
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.