Is there a public PoC exploit available for CVE-2026-16212?

Yes, a public proof-of-concept exploit is available for CVE-2026-16212. Prioritise patching immediately. EPSS: 0.2%.

django-shop CVE-2026-16212

Q: What is the CVSS score of CVE-2026-16212?

CVE-2026-16212 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45423 LOW

Race Condition (CWE-362)

2026-07-19 VulDB

GHSA-5982-pmj5-rx9v

Python Information Disclosure Race Condition Django Shop

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Network vector with high complexity reflects the race timing requirement; PR:L for required authenticated session; no confidentiality impact per VC:N in source vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 19, 2026 - 05:22 NVD

2.3 (LOW) 1.3 (LOW)

Analysis Generated

Jul 19, 2026 - 05:21 vuln.today

CVE Published

Jul 19, 2026 - 03:45 cve.org

LOW 2.3

DescriptionCVE.org

A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.

Technical ContextAI

django-shop (CPE: cpe:2.3:a:awesto:django-shop:*:*:*:*:*:*:*:*) is a Python/Django-based e-commerce framework. The flaw resides in shop/models/inventory.py, specifically within the Purchase Stock Handler, which manages stock reservation and decrement during checkout. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause: the handler does not use atomic database operations or advisory locks to guard the read-modify-write sequence on inventory quantities, creating a classic time-of-check to time-of-use (TOCTOU) window. In a concurrent web environment served by multiple Django workers or threads, two simultaneous requests can both read the same stock quantity, both pass the availability check, and both decrement, resulting in oversold inventory or corrupted stock counts.

RemediationAI

No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the disclosure. As a primary compensating control, wrap stock decrement operations in database-level atomic transactions using Django's select_for_update() on the inventory queryset inside a transaction.atomic() block, which acquires a row-level lock and eliminates the TOCTOU window; this requires no framework changes and can be applied as a local patch. Alternatively, implement application-level distributed locking (e.g., Redis-based locks via django-redis) around the purchase stock handler to serialize concurrent requests for the same product. Restricting checkout concurrency via rate-limiting authenticated requests per user per product (e.g., using django-ratelimit on the purchase endpoint) reduces exploitation surface at the cost of degraded user experience under legitimate high load. Consider pinning to the most recently functional version and monitoring the upstream repository at https://github.com/awesto/django-shop/ for any future patch release.