CVE-2025-27130

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Welcart Inc.	Welcart e-Commerce	2.11.6 and earlier versions

References

https://jvn.jp/en/jp/JVN87266215/Third Party Advisory
https://www.welcart.com/archives/23868.htmlRelease Notes

Timeline

Published: Apr 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271315.5in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.CVE-2025-271327.8in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. CVE-2025-271338.8WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3 CVE-2025-271348.8Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to CVE-2025-271359.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL CVE-2025-271365.5LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoin CVE-2025-271374.4Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Depend CVE-2025-271389.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication CVE-2025-271395.4Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting wh CVE-2025-27144.3A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functi CVE-2025-271409.8WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4