VulnerabilityPublished 13 Aug 2025Updated 19 Aug 2025

CVE-2025-52392: Soosyze CMS · Improper Restriction of Excessive Authentication Attempts

Source CVE Database V5

Public exploit available (Exploit-DB) · CVSS 5.4 Medium.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

5.4Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.8% chance of exploitation in 30 days – higher than 59% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 13 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: evidence found.
1 Exploit-DB entry, 5 days after disclosure
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by MITRE Corporation
16 Jun 2025, 58 days before disclosure
CVE published
on cve.org
13 Aug 2025, t = 0
In Threat Radar
record ingested
13 Aug 202514:19 UTC, the same day as disclosure
First Exploit-DB entry (opens in a new tab)
Soosyze CMS 2.0 - Brute Force Login
18 Aug 2025, 5 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, European organizations should implement the following specific measures: 1) Deploy web application firewalls (WAFs) with rules to detect and block brute-force login attempts targeting the /user/login endpoint, including rate-limiting based on IP address and request frequency. 2) Enforce multi-factor authentication (MFA) for all administrative accounts to reduce the risk of unauthorized access even if credentials are compromised. 3) Monitor login attempts and set up alerts for unusual authentication patterns indicative of brute-force attacks. 4) Restrict login access by IP address or network segment where feasible, limiting exposure to the public internet. 5) Encourage strong password policies and regular password changes for administrative users. 6) Engage with Soosyze CMS developers or community to track the release of official patches or updates addressing this vulnerability and plan prompt deployment once available. 7) Consider temporary disabling or restricting the /user/login endpoint if possible during high-risk periods. These measures go beyond generic advice by focusing on compensating controls tailored to the specific vulnerability and CMS environment.

Description

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.

Impact

For European organizations using Soosyze CMS 2.0, this vulnerability poses a significant risk to the confidentiality and integrity of their web content and administrative controls. Unauthorized administrative access could lead to website defacement, data theft, insertion of malicious content, or use of the CMS as a pivot point for further network compromise. Given the CMS's role in managing web content, attacks could disrupt business operations, damage brand reputation, and lead to regulatory compliance issues, especially under GDPR if personal data is exposed or manipulated. The medium CVSS score indicates a moderate risk, but the ease of exploitation (no privileges required and low complexity) means attackers can attempt brute-force attacks remotely over the internet. This risk is heightened for organizations that do not implement additional protective controls such as web application firewalls or multi-factor authentication. Since no patches are currently available, organizations must rely on compensating controls to mitigate the threat.

CWE-307Improper Restriction of Excessive Authentication Attempts (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Architecture and Design
Common protection mechanisms include: Disconnecting the user after a small number of failed attempts; Implementing a timeout; Locking out a targeted account; Requiring a computational task on the user's part.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authentication (opens in a new tab)
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP ASVS 4.0.3
V2.2.1 (opens in a new tab)
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
Attack patterns
Dictionary-based Password Attack (opens in a new tab)
Password Brute Forcing (opens in a new tab)
Password Spraying (opens in a new tab)
Credential Stuffing (opens in a new tab)
Use of Known Kerberos Credentials (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Description

AI analysisMachine-generated, updated 21 Aug 2025, 00:49 UTC

Public exploits and detection1 Exploit-DB entry

WeaknessesCWE-307

Technical details

References

Community reviews

Related threats