CVE-2018-25435

ZeusCart 4.0 Deactivate Customer Accounts CSRF

CVSS 6.9 MEDIUMEPSS 0.2%CWE-352

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 6.9EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

01 Jun 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests to the regstatus endpoint with action=deny parameters.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Affected products

zeuscart · ZeusCart

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/46027unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://http://www.zeuscart.com/https://www.exploit-db.com/exploits/46027 https://www.vulncheck.com/advisories/zeuscart-deactivate-customer-accounts-csrf