CVE-2026-15491
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A missing authentication vulnerability has been found in an unknown part of TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The flaw can be exploited remotely without authentication.
Risk Assessment
Lack of authentication may allow an unauthorized attacker to remotely access sensitive functions or data, potentially compromising confidentiality and integrity of the system.
Recommendation
Immediately update TOKO-ONLINE-ROTI to the latest rolling release version. If no patch is available, consider restricting access to the vulnerable component via firewall or ACL rules.
Other vulnerabilities in TOKO-ONLINE-ROTI
See all- CVE-2026-15909Medium
A vulnerability was found in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 in an unknown function of the file proses/add.php. Manipulation of the argument kd_cs leads to authorization bypass. The attack can be carried out remotely.
- CVE-2026-15490High
A security flaw has been discovered in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The vulnerability is an SQL injection in the proses/add.php file, where the kode_produk or kd_cs arguments can be manipulated remotely. The exploit has been publicly released and may be used in attacks.
- CVE-2026-15489High
A SQL injection vulnerability exists in the proses/login.php file of TOKO-ONLINE-ROTI (up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) via the Username argument. Remote exploitation is possible and a public exploit is available.
Original NVD description (English source)
A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.