CVE-2026-2010

Katalog CVE

CVSS 4.2 · Medium EPSS 0,37%

Kerentanan Incorrect Privilege Assignment pada publiccms. Skor CVSS 3.1 4.2 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sanluan/PublicCMS/issues/108 exploit · advisory vendor
• https://github.com/sanluan/PublicCMS/issues/108#issue-3838143772 exploit · advisory vendor
• https://github.com/sanluan/PublicCMS/commit/7329437e1288540336b1c66c114ed3363adcba02 patch
• https://vuldb.com/?id.344592 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.743487 advisory pihak ketiga · vdb entry
• https://github.com/sanluan/PublicCMS/ product
• https://vuldb.com/?ctiid.344592 permissions required · vdb entry