Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• vuldb.com/cve/CVE-2026-120319 Üçüncü taraf
• vuldb.com/submit/1016201 Üçüncü taraf
• vuldb.com/vuln/429652 Diğer
• vuldb.com/vuln/429652/cti Diğer

Kayıt geçmişi

1. 2 Kas 2026 04:15Yayımlandı

İlgili açıklar

• 6,3 CVE-2026-121583Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
• 4,3 CVE-2026-121585InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
• 6,5 CVE-2026-121582Umami Record API Endpoint route.ts authorization
• 6,5 CVE-2026-121734ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
• 2,7 CVE-2026-121732RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
• 6,5 CVE-2026-116669Tanium addressed an improper access controls vulnerability in Discover.