Django Shop
Monthly
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.