Deserialization in Aridius Xyz
CVE-2025-0841
A vulnerability has been found in Aridius XYZ up to 20240927 on OpenCart and classified as critical. This vulnerability affects the function loadMore of the component News. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.005 (38.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Aridius Xyz — versions 20240927
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (exploit)
Frequently asked questions
- What is CVE-2025-0841?
- CVE-2025-0841 is a high-severity vulnerability in Aridius Xyz, classified under Improper Input Validation. CVSS score: 7.3/10. Published 2025-01-29.
- How severe is CVE-2025-0841?
- High severity. CVSS v3 base score is 7.3 out of 10.