Threats tagged 'ghsa-2xhq-9mxg-mc67'

A vulnerability in Sanluan PublicCMS versions 4.x, 5.x, and 6.x affects the TradeRefundService.updateAmound function in the publiccms-trade component. Manipulating the refundId argument can lead to an authorization bypass, allowing remote attackers to exploit this flaw. The vulnerability has a CVSS score of 6.3 (medium severity) and public exploit code is available. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently provided.