Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-2010 A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade… https://www.cve.org/CVERecord?id=CVE-2026-2010
Post summary
The text announces the discovery of CVE-2026-2010 in Sanluan PublicCMS, noting it impacts the Paid function, but provides no further technical details, PoC, or exploit information.
CVE-2026-2010 Improper Authorization Vulnerability in PublicCMS Trade Payment Handler https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2010
Post summary
The text announces CVE‑2026‑2010 as an improper authorization vulnerability affecting the PublicCMS Trade Payment Handler, without providing PoC, exploit, or remediation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | publiccms | publiccms | - | - | - |