high5.4Public exploit code
CVE-2025-52392
Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Soosyze CMS 2.0 - Brute Force Login2025-08-18 · webapps · multiple
Impact
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | soosyze/soosyze | <= 2.0.0 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392
- https://github.com/soosyze/soosyze/issues/269
- https://www.exploit-db.com/exploits/52416
- https://github.com/advisories/GHSA-vq9x-w82r-rhmc
- https://nvd.nist.gov/vuln/detail/CVE-2025-52392