CVE-2026-2010

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-266 CWE-285 CWE-639

Affected software

Vendor	Product	Versions
Sanluan	PublicCMS	4.0.202506.a; 4.0.202506.b; 4.0.202506.c; 4.0.202506.d; 5.202506.a; 5.202506.b; 5.202506.c; 5.202506.d; 6.202506.a; 6.202506.b; 6.202506.c; 6.202506.d

References

https://github.com/sanluan/PublicCMS/Product
https://github.com/sanluan/PublicCMS/commit/7329437e1288540336b1c66c114ed3363adcba02Patch
https://github.com/sanluan/PublicCMS/issues/108Exploit, Vendor Advisory
https://github.com/sanluan/PublicCMS/issues/108#issue-3838143772Exploit, Vendor Advisory
https://vuldb.com/?ctiid.344592Permissions Required, VDB Entry
https://vuldb.com/?id.344592Third Party Advisory, VDB Entry
https://vuldb.com/?submit.743487Third Party Advisory, VDB Entry

Timeline

Published: Feb 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-201007.7A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Softw CVE-2026-201018.6A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an un CVE-2026-201026.1A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense CVE-2026-201038.6A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Fi CVE-2026-201046.1A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series S CVE-2026-201057.7A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Fi CVE-2026-201065.3A vulnerability in the Remote Access SSL VPN, HTTP management and MUS functionality, of Cisco Secure Firewall Adaptive Security Appliance (A CVE-2026-201075.5A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated,CVE-2026-201085.4A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to cond CVE-2026-201094.8Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified CVE-2026-20119.8A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/e CVE-2026-201106.5A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) conditio