# CVE-2025-50850: CS-Cart missing rate limiting in vendor login

Source: https://junglewise.ai/threats/cve-2025-50850-cs-cart-missing-rate-limiting-in-vendor-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-31. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-50850 · Severity: high · CVSS 8.6 · Published 2025-07-31

CS-Cart, a popular e-commerce platform, contains a security flaw in its vendor login system. The system fails to limit the number of times a user can try to log in, allowing attackers to repeatedly guess passwords until they gain access. If successful, an attacker could take over vendor accounts, potentially leading to the theft of customer data, financial loss, or disruption of store operations.

Technologies: [Cs-Cart](https://junglewise.ai/threats/technologies/cs-cart). Vendors: [Cs-Cart](https://junglewise.ai/threats/vendors/cs-cart).

## Quick answers

**Is CVE-2025-50850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-50850 being exploited in the wild.

**How severe is CVE-2025-50850?** High severity, with a CVSS score of 8.6, published 31 July 2025.

**Which products and versions are affected?** Cs-Cart 4.18.3.

**Is there a fix for CVE-2025-50850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-50850 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-50850?** Check whether you run Cs-Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A lack of rate limiting and anti-automation controls was identified in the vendor login functionality (vendor.php) of CS-Cart version 4.18.3. The application does not implement CAPTCHA verification, account lockouts, or request throttling after failed authentication attempts. This allows a remote, unauthenticated attacker to perform automated brute-force or credential-stuffing attacks. Successful exploitation can lead to full account takeover of vendor profiles. Mitigation involves implementing reCAPTCHA and account lockout thresholds.

## Affected products

- CS-Cart CS-Cart 4.18.3

## Timeline

- 2025-07-31: advisory: NVD published the CVE record

## References

- [https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md](https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md)

## Related threats

- [CS-Cart unrestricted HTML file upload in File Manager](https://junglewise.ai/threats/cve-2025-50848-cs-cart-unrestricted-html-file-upload-in-file-manager)
- [CS-Cart CSRF in product comparison list](https://junglewise.ai/threats/cve-2025-50847-cs-cart-csrf-in-product-comparison-list)
- [CS-Cart IDOR in vendor sticker management](https://junglewise.ai/threats/cve-2025-50849-cs-cart-idor-in-vendor-sticker-management)