CVE-2025-0974 json
MaxD Lightning Module deserialization
published 2025-02-03 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-1952
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
A vulnerability was determined in MaxD Lightning Module 4.43/4.44 on OpenCart. This issue affects some unknown processing. Executing a manipulation of the argument li_op/md can lead to deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.45 is capable of addressing this issue. Upgrading the affected component is advised.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/mcdruid/f8153d7d535c0fcba920e83a64953d4e referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 5.0 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 4.6 | AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 1.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.6 | AV:N/AC:H/Au:S/C:P/I:P/A:P |
Affected products
- MaxD Lightning Module
Classification
References
-
lightning.devs.mx
/download
patch
-
gist.github.com
/mcdruid/f8153d7d535c0fcba920e83a64953d4e
exploit
-
vuldb.com
/vuln/294365
vdb-entry, technical-description
-
vuldb.com
/vuln/294365/cti
signature, permissions-required
-
vuldb.com
/submit/489672
third-party-advisory
Sources
- CVE List CVE-2025-0974
- NVD CVE-2025-0974
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.