CVE-2026-110607
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
BizSpring Shop
- Vendor
- BizSpring
- Product
- BizSpring Shop
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://github.com/BizSpringSource/bizspring-shop-opensource
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | git | Unavailable | cf22d39daaf17f430d8fc1fb698a2f6e515e1808 | None listed |
BizSpring Java Mall
- Vendor
- BizSpring
- Product
- BizSpring Java Mall
- Platforms
- Unknown
- Default status
unaffected- Package collection
- https://github.com/bizspring-open/BizSpring-Java-Mall
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | git | Unavailable | 369e88c5cda36ddcea56742c335ee1bfe50e8156 | None listed |