PT-2026-41524 · Publiccms · Publiccms

Vulnplusbot · Published 2026-05-17 · Updated 2026-05-17 · CVE-2026-8738

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS version 5.202506.d

Description A business logic error exists in the Trade Payment Flow component within the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java. This issue affects the functions TradeOrderController.pay(), TradePaymentController.pay(), and AccountGatewayComponent.pay(), allowing for remote exploitation.

Recommendations As a temporary workaround, consider restricting access to the functions TradeOrderController.pay(), TradePaymentController.pay(), and AccountGatewayComponent.pay() to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2026-8738

Affected Products

Publiccms

References · 7

• 🔥 https://vulnplus-note.wetolink.com/share/ayeMf4xWK0ZZ · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8738 · Security Note
• https://vuldb.com/vuln/364326 · Note
• https://t.me/cveNotify/163767 · Telegram Post
• https://vuldb.com/vuln/364326/cti · Note
• https://vuldb.com/submit/809905 · Note
• https://t.me/CVEtracker/54037 · Telegram Post