Threat Intelligence Database

A vulnerability exists in WonderTrader up to version 0.9.9 in the Pending Order Handler component, specifically in the _undone_qty function. The issue involves manipulation of the getUndoneQty argument, which can enforce unintended behavioral workflow. The vulnerability can be exploited remotely. Public exploit code is available. The vendor has not responded to disclosure requests. The CVSS score is 4.3, indicating a low severity impact.

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability exists in WonderTrader up to version 0.9.9 affecting the TraderDD::queryTrades function. The issue involves manipulation of the argument FID_JYLB, which can enforce behavioral workflow changes. The attack can be performed remotely but requires high complexity and is difficult to exploit. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild.

CVE-2026-19208 is a medium severity vulnerability in WonderTrader versions 0.9.0 through 0.9.9. It affects the TraderDD::queryTrades function in the source file src/TraderDD/TraderDD.cpp. The vulnerability involves manipulation of the argument FID_JYLB, which results in enforcement of behavioral workflow. The attack can be launched remotely but requires high complexity and is difficult to exploit. The exploit code is publicly available. The vendor has not responded or provided a fix.

CVE-2026-19037 is a medium severity vulnerability in WonderTrader versions 0.9.0 through 0.9.9. It affects the MatchEngine::update_lob function in the Internal Limit Order Book Cache Handler component. The vulnerability allows remote exploitation that manipulates enforcement of behavioral workflow. Public exploit code is available, but the vendor has not responded or provided a fix.