CVE-2026-8737

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x affecting TradeRefundService.updateAmound in the publiccms-trade component. Manipulation of the refundId argument results in authorization bypass, and the attack can be initiated remotely. The exploit has been made public and could be used.

PublicCMS V5.202506.b is vulnerable to SSRF in the chat interface of SimpleAiAdminController.

PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.

A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. The vulnerability affects the CmsContentAdminController function in SysUserAdminController.java within the exportExcel/exportData component. Manipulation of the userId/deptId arguments causes authorization bypass, and the attack can be initiated remotely. The exploit has been made publicly available and could be used for attacks.

A flaw was found in PublicCMS 5.202506.d in the execute function of TemplateResultDirective.java (templateResult API component). Manipulation of the templateContent argument causes improper neutralization of special elements in the template engine, allowing remote attack. The exploit has been published and may be used.

A vulnerability was detected in Sanluan PublicCMS 5.202506.d in the getSignKey function of SafeConfigComponent.java. Manipulating the privatefile_key argument results in the use of a hard-coded cryptographic key. The attack can be executed remotely and the exploit is publicly available.

In PublicCMS 5.202506.d, the TradeOrderController.pay, TradePaymentController.pay, and AccountGatewayComponent.pay functions in the trade payment flow lead to business logic errors. The attack can be launched remotely and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

In PublicCMS up to 6.202506.d, the ZipSecureFile.setMinflateRatio function in DocToHtmlUtils.java allows resource consumption. The attack can be launched remotely, and the vendor did not respond to the disclosure.