CVE-2025-15244
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used.
Risk Assessment
A race condition could allow unauthorized operations in the purchase process, potentially leading to data integrity compromise or unauthorized transactions, but due to the difficulty of exploitation the risk is moderate.
Recommendation
Update PHPEMS to a version above 11.0 if a fix is available. Monitor the system for unusual activities related to purchase requests.
Other vulnerabilities in PHPEMS
Original NVD description (English source)
A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS