CVE-2025-15242

Katalog CVE

CVSS 3.1 · Low EPSS 0,23%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada phpems. Skor CVSS 3.1 3.1 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit is now public and may be used.

Rincian

Terbit di NVD

30 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

3.1 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://byebydoggy.github.io/post/2025/1229-phpems-coupon-recharge-race-condition-poc/ exploit · mitigasi · advisory pihak ketiga
• https://vuldb.com/?id.338632 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.725661 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.338632 permissions required · vdb entry