CVE-2026-19975
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.
Risk Assessment
The risk includes potential unauthorized money transfers or transaction integrity compromise, which could lead to financial losses.
Recommendation
It is recommended to upgrade to version 1.2.13, which includes the patch ae5596a9548e010a8a79838806eff60ef9554539.
Other vulnerabilities in Azuriom CMS
See all- CVE-2026-54415High
Missing authorization in the server management routes in Azuriom CMS before version 1.2.11 allows an authenticated attacker with admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses.
- CVE-2025-65271High
Client-side template injection (CSTI) in the Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.
Original NVD description (English source)
A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS