Read the docs
TI-2026-16196 Aliases CVE-2026-19975GHSA-m9j6-2rfj-56fw

Azuriom CMS Money Transfer ProfileController.php transferMoney toctou

Priority MEDIUM 45CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix Fixed CMS (Azuriom): 1.2.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AzuriomCMS1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; 1.2.6; 1.2.7; 1.2.8; 1.2.9; 1.2.10; 1.2.11; 1.2.121.2.13Patch availableCNA
  • CMS VendorAzuriom Affected 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; 1.2.6; 1.2.7; 1.2.8; 1.2.9; 1.2.10; 1.2.11; 1.2.12 Fixed in 1.2.13 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:azuriom:cms:*:*:*:*:*:*:*:*——Azuriom
  • cpe:2.3:a:azuriom:cms:*:*:*:*:*:*:*:* Versions — — ·Azuriom

Remediation

  • Fix · CNA CMS (Azuriom) Fixed in 1.2.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19975
  2. 2026-10-03 Alias added: GHSA-m9j6-2rfj-56fw

References

Patch 2

  • TI-2025-40310 Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a… CVSS 3.1HIGH 8.8
  • TI-2026-39291 Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences