Threat database

CVE-2026-110608 is an authorization bypass vulnerability in BizSpring Shop's OrderController cancel and receive handlers. Authenticated users can manipulate the orderId parameter to act on orders belonging to other members. This allows attackers to cancel pending orders or confirm receipt of shipped orders without the victim's consent, potentially disrupting order fulfillment and stock allocation.

CVE-2026-110607 is a high-severity vulnerability in BizSpring Shop version 0 that allows authenticated buyers to bypass payment verification. By exploiting the PaymentController.testPostPay handler, attackers can mark orders as paid without actual payment. This enables unauthorized acquisition of goods or settling other members' orders fraudulently.