CVE-2026-19975
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.
Risk Assessment
The risk includes potential unauthorized money transfers or transaction integrity compromise, which could lead to financial losses.
Recommendation
It is recommended to upgrade to version 1.2.13, which includes the patch ae5596a9548e010a8a79838806eff60ef9554539.
Original NVD description (English source)
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.