CVE-2025-30073 Business logic in n/a
Attackers can exploit transaction reference reuse to transfer more funds to employee cards than paid, affecting OPC card systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30073?
CVE-2025-30073 is a high-severity vulnerability in n/a, published on 26 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions with the same reference are completed, depending on timing. This can be used to transfer more money onto employee cards than is paid.
Weakness: CWE-488
Which versions are affected by CVE-2025-30073?
How do I fix CVE-2025-30073?
No fix has been published for CVE-2025-30073 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30073 being exploited?
There is no known exploitation of CVE-2025-30073 in the wild and no public exploit code.
Sources
Also known as GHSA-cjp9-h6x7-98p3.