CVE-2025-15618

CVE-2025-15618 is a critical vulnerability affecting Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl, where an insecure secret key is generated using a cryptographically weak method (MD5 of a single rand() call) for encrypting credit card transaction data. Rated 9.1 CRITICAL, this vulnerability allows an unauthenticated attacker to exploit it over the network with low complexity, potentially leading to high confidentiality and integrity impacts, including the disclosure or tampering of sensitive payment information. While there is no evidence of active exploitation, no public exploit code, and a very low EPSS score, the vulnerability has garnered some community discussion across social media and mailing lists.