GHSA-vq9x-w82r-rhmc

Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

Source: GitHub Advisory Database (reviewed) High CVE-2025-52392

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	soosyze/soosyze	<= 2.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-52392 advisory
https://github.com/soosyze/soosyze/issues/269 web
https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392 web
https://github.com/soosyze/soosyze package
https://www.exploit-db.com/exploits/52416 web