CVE-2025-52392

State: Published
Severity: 5.4 Medium
Published: Aug 13, 2025
Updated: Aug 19, 2025
Reserved: Jun 16, 2025

Description

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N	CISA-ADP

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/soosyze/soosyze/issues/269
https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392
https://www.exploit-db.com/exploits/52416

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.