CVE-2025-10216
LOWGrandNode < 2.3.0 - Race Condition in Voucher Handler via giftvouchercouponcode
Title source: llmDescription
A vulnerability was detected in GrandNode up to 2.3.0. The impacted element is an unknown function of the file /checkout/ConfirmOrder/ of the component Voucher Handler. The manipulation of the argument giftvouchercouponcode results in race condition. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
References (3)
Core 3
Core References
Permissions Required, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.323485
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.323485
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.640784
Scores
CVSS v3
2.6
EPSS
0.0017
EPSS Percentile
6.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-362
Status
published
Products (4)
n/a/GrandNode
2.0
n/a/GrandNode
2.1
n/a/GrandNode
2.2
n/a/GrandNode
2.3.0
Published
Sep 10, 2025
Tracked Since
Feb 18, 2026