CVE-2026-110113
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Risk Assessment
The risk includes unauthorized modification of customer data, privacy breaches, and potential delivery fraud.
Recommendation
Verify ownership of the record and site association before saving an address, and consider using random identifiers instead of sequential ones.
Other vulnerabilities in PublicCMS
See all- CVE-2025-65836Critical
PublicCMS V5.202506.b is vulnerable to SSRF in the chat interface of SimpleAiAdminController.
- CVE-2023-34852Critical
PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.
- CVE-2026-109160Medium
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-97721Low
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. The vulnerability affects the CmsContentAdminController function in SysUserAdminController.java within the exportExcel/exportData component. Manipulation of the userId/deptId arguments causes authorization bypass, and the attack can be initiated remotely. The exploit has been made publicly available and could be used for attacks.
Original NVD description (English source)
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS