CVE-2018-25435CWE-352csrf

CVE-2018-25435

Medium · published June 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
4.4
In the wild
Unconfirmed
What it is

ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00156 · 4.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-06-02T02:16Z
References (3)
http://http://www.zeuscart.com/ · [email protected]https://www.exploit-db.com/exploits/46027 · [email protected]https://www.vulncheck.com/advisories/zeuscart-deactivate-customer-accounts-csrf · [email protected]
EPSS history
Timeline
  • 01 JUN 21:00Z
    ZeusCart 4.0 Deactivate Customer Accounts CSRF
    cvelistv5