Race Condition Vulnerability in OpenCart Single-Use Coupon Handler
CVE-2025-15116

6.3MEDIUM

Key Information:

Vendor: OpenCart
Status: Opencart
Vendor: CVE Published:; 28 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15116?

A security flaw has been identified in OpenCart up to version 4.1.0.3, specifically within the Single-Use Coupon Handler component. This vulnerability allows remote attackers to manipulate the race condition, potentially leading to unauthorized actions. Although the complexity of the exploit is considered high, paving the way for intricate attack methods, its public disclosure means it can be targeted by malicious actors. It's noteworthy that the vendor was contacted regarding this vulnerability but did not provide any response.

Affected Version(s)

OpenCart 4.1.0.0

OpenCart 4.1.0.1

OpenCart 4.1.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15116 - Proof of Concept