CVE-2025-15116

Katalog CVE

CVSS 4.8 · Medium EPSS 0,37%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada opencart. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler. Performing a manipulation results in race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

28 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/KhanMarshaI/a55f125a55de1c0d4f41e66236027e01 exploit · advisory pihak ketiga
• https://gist.github.com/KhanMarshaI/a55f125a55de1c0d4f41e66236027e01#steps-to-reproduce exploit · advisory pihak ketiga
• https://vuldb.com/?id.338494 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.711745 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.338494 permissions required · vdb entry