CVE-2025-0580

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?route=extension/module/rest_api&action=getOrders of the component REST API Module. The manipulation of the argument contentHash leads to incorrect authorization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jan 20, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-05815.4A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the fiCVE-2025-05827.2A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code oCVE-2025-05836.1The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute aCVE-2025-05845.3The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerabilityCVE-2025-05859.8The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commaCVE-2025-05867.2The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privilCVE-2025-05877.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. ThiCVE-2025-05884.9In affected versions of Octopus Server it was possible for a user with sufficient access to set custom headers in all server responses. By sCVE-2025-05895.3In affected versions of Octopus Deploy where customers are using Active Directory for authentication it was possible for an unauthenticated CVE-2025-05907.5Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk.CVE-2025-05917.8Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an appliCVE-2025-05928.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploadin