CVE-2024-53476

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Dec 27, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-534779.8JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java CVE-2024-53488.8The Elements For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.1 via the 'bef CVE-2024-534809.8Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter.CVE-2024-534816.1A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to CVE-2024-534848.8Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.CVE-2024-53498.8The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3 CVE-2024-534907.5Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java.CVE-2024-534947.5Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authenti CVE-2024-534957.5Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authent CVE-2024-534969.8Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authenti CVE-2024-534999.8Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.CVE-2024-53509.8A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the f