CVE-2026-120319

MediumCVSS 6.3/10Last modified Nov 5, 2026

Description

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285 CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2026
Last modified: Nov 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-120323.1Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised CVE-2026-1203204.7A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of CVE-2026-1203229.9A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-man CVE-2026-1203234.3A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthrou CVE-2026-1203248.3A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file CVE-2026-1203256.3A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packag CVE-2026-1203264.8DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When CVE-2026-1203275.3The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect use CVE-2026-1203286.9The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can CVE-2026-1203295.3Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configura CVE-2026-120335.3Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to CVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or rec