CVE-2026-116274

MediumCVSS 4.3/10Last modified Nov 2, 2026

Description

A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
n/a	JIZHICMS	2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; 2.5.6

References

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1162756.3A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/co CVE-2026-116286.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physica CVE-2026-1162805.5A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-ap CVE-2026-1162813.3A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-eng CVE-2026-1162824.3A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file CVE-2026-1162834.3A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. Thi CVE-2026-1162844.3A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of CVE-2026-1162857.5HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In c CVE-2026-1162899.1Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-t CVE-2026-116298.8Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2026-1162966.5The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with w CVE-2026-11634.1An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active