---
id: CVE-2025-15244
title: A vulnerability has been found in PHPEMS up to 11.0
summary: >-
  A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown
  function of the component Purchase Request Handler. The manipulation leads to
  race condition. The attack may be initiated remotely. A high degree of
  complexity …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-362
vendor: phpems
product: phpems
affected:
  - phpems <= 11.0
published: '2025-12-30'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T17:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15244'
references:
  - url: >-
      https://byebydoggy.github.io/post/2025/1229-phpems-points-race-condition-poc/
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.338634'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.338634'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.725727'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00408
epssPercentile: 0.32722
ingestedAt: '2026-10-05T17:27:45.025Z'
---

## Overview

A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race condition. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used.

## Affected

- `phpems <= 11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.