CVE-2026-108568
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was determined in InstantSoft icms2 up to 2.18.2, affecting the validatePaypalOrder function in system/controllers/billing/actions/paypal.php of the Billing Module component. Manipulation of the bid/sig arguments leads to insufficient verification of data authenticity. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
The vulnerability may allow an attacker to bypass PayPal transaction verification, potentially leading to financial fraud or unauthorized actions. The vendor's lack of response increases the risk.
Recommendation
Immediately restrict access to the Billing module and strengthen transaction signature verification. Monitor for a patch and consider temporarily disabling PayPal integration.
Other vulnerabilities in InstantSoft icms2
See all- CVE-2023-4188Critical
There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2026-108567Medium
A vulnerability was found in InstantSoft icms2 up to 2.18.2, impacting the files_delete_file function in system/fields/image.php of the Image Handler component. Manipulation of the size argument results in path traversal. The attack can be initiated remotely and the exploit is publicly available. The patch is named 03d70937f1ff97031523222808726994b8b79379.
- CVE-2023-4704Medium
In the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, there is an external control of system or configuration settings.
- CVE-2023-4655Medium
The GitHub repository instantsoft/icms2 prior to version 2.16.1 has a reflected Cross-site Scripting (XSS) vulnerability.
- CVE-2023-4654Low
In the GitHub repository instantsoft/icms2 prior to version 2.16.1, there is a vulnerability related to a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute.
- CVE-2023-4651Medium
There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1. This may lead to unauthorized access to internal server resources.
- CVE-2023-4649Medium
Session Fixation vulnerability in GitHub repository instantsoft/icms2 prior to version 2.16.1.
- CVE-2023-4189Medium
A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.
- CVE-2023-4187Medium
A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.
Original NVD description (English source)
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS