{"id":"CVE-2018-25435","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-25435","generatedAt":"2026-10-28T21:31:03.423Z","title":"ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests.","description":"ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.","published":"2026-06-01T22:16:17.000Z","lastModified":"2026-10-06T22:10:00.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-352"],"affected":[],"epss":{"score":0.00156,"percentile":0.04744,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://http://www.zeuscart.com/","source":"disclosure@vulncheck.com"},{"url":"https://www.exploit-db.com/exploits/46027","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zeuscart-deactivate-customer-accounts-csrf","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-25435","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}