CVE-2025-15116 OpenCart Single-Use Coupon race condition

A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler. Performing a manipulation results in race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The...

CVE-2025-15116

CVE-2025-15116 affects OpenCart up to 4.1.0.3, due to a race condition in the Single-Use Coupon Handler. The issue can be triggered remotely with high attack complexity; exploitation has been publicly released and the vendor reportedly did not respond. Red Hat and other sources corroborate the Op...

PT-2025-53660

Name of the Vulnerable Software and Affected Versions dayrui XunRuiCMS versions up to 4.7.1 Description A flaw exists in dayrui XunRuiCMS that allows for cross site scripting. The issue is located in the JSONP Callback Handler component, specifically within the dr show error/dr exit msg function ...

PT-2025-53645

Name of the Vulnerable Software and Affected Versions shanyu SyCms versions up to a242ef2d194e8bb249dc175e7c49f2c1673ec921 Description A code injection issue exists in shanyu SyCms. The issue is located in the addPost function within the Application/Admin/Controller/FileManageController.class.php...

PT-2025-53673

Name of the Vulnerable Software and Affected Versions Tenda WH450 version 1.0.0.18 Description A stack-based buffer overflow exists due to manipulation of the delno argument in an unknown function of the /goform/PPTPUserSetting file. Remote exploitation is possible. The exploit has been made...

PT-2025-53682

Name of the Vulnerable Software and Affected Versions Tenda AC10U versions 15.03.06.48 through 15.03.06.49 Description A buffer overflow issue exists in the Tenda AC10U. The vulnerability is located in the fromadvsetlanip function within the /goform/AdvSetLanip file, specifically within the POST...

PT-2025-53642

Name of the Vulnerable Software and Affected Versions FantasticLBP Hotels Server affected versions not specified Description A security issue exists in FantasticLBP Hotels Server related to the /controller/api/Room.php file. Manipulation of the hotelId argument can lead to SQL injection. This...

PT-2025-53631

Name of the Vulnerable Software and Affected Versions OpenCart versions prior to 4.1.0.4 Description A security issue exists in OpenCart related to the Single-Use Coupon Handler component. Manipulation of this component can lead to a race condition. The issue can be exploited remotely and is...

PT-2025-53671

Name of the Vulnerable Software and Affected Versions floooh sokol affected versions not specified Description A flaw exists in the sg pipeline desc defaults function within the sokol gfx.h library. This issue leads to a stack-based buffer overflow and requires local access for exploitation. The...

EUVD-2025-205482

A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is...

CVE-2025-15106

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploi...

CVE-2025-15106

The CVE-2025-15106 vulnerability affects the getmaxun project’s Authentication Endpoint, specifically the router.get in file server/src/routes/auth.ts. The underlying issue is improper authorization caused by manipulation of router.get, with remote exploit potential and a publicly available explo...

CVE-2025-15097

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used...

CVE-2025-15095

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used...

CVE-2025-15094

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl ca...

CVE-2025-15092

A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the argument remark leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be us...

PT-2025-53618

Name of the Vulnerable Software and Affected Versions getmaxun versions prior to 0.0.28 Description A weakness exists in the Authentication Endpoint component of getmaxun. Specifically, the router.get function within the server/src/routes/auth.ts file is susceptible to improper authorization due ...

PT-2025-53626

Name of the Vulnerable Software and Affected Versions jackq XCMS versions prior to 3fab5342cc509945a7ce1b8ec39d19f701b89261 Description A flaw exists in jackq XCMS that allows for unrestricted file upload. The issue is located in the Upload function within the...

PT-2025-53628

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-800MB version 1.0.1.0 Description A command injection issue exists in the TRENDnet TEW-800MB. The issue is located in the NTPSyncWithHost.cgi file, specifically within the sub F934 function. Successful exploitation allows for remo...

PT-2025-53627

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-800MB version 1.0.1.0 Description A security issue has been identified in TRENDnet TEW-800MB version 1.0.1.0. The issue resides in the Management Interface component, specifically within the do setWizard asp function located in th...