CVE-2025-15582

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-285 CWE-639

Affected software

Vendor	Product	Versions
detronetdip	E-commerce	1.0.0

References

https://github.com/Nixon-H/Ecommerce-IDOR-Product-ManipulationExploit, Mitigation, Third Party Advisory
https://github.com/detronetdip/E-commerce/Product
https://github.com/detronetdip/E-commerce/issues/23Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.346486Permissions Required, VDB Entry
https://vuldb.com/?id.346486Third Party Advisory, VDB Entry
https://vuldb.com/?submit.754030Third Party Advisory, VDB Entry

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155835.4A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. E CVE-2025-155846.8Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation o CVE-2025-155856.7Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successf CVE-2025-1558610.0OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can r CVE-2025-155878.6Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password b CVE-2025-155897.2A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.ph CVE-2025-15596.4The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode in all versions up t CVE-2025-155915.3Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious c CVE-2025-155957.8Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.CVE-2025-155976.3A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistan CVE-2025-155985.9A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middlew CVE-2025-155996.1DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute