CVE-2026-120319

Description

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-639, CWE-285
Reserved: 2026-11-01
Published: 2026-11-02 01:15 UTC
Last updated: 2026-11-02 01:15 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120319.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-114922
Assigner: VulDB
Published: Nov 2, 2026, 1:15:23 AM
Updated: Nov 2, 2026, 1:15:23 AM
EUVD base score (CVSS 4.0): 5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EUVD-reported EPSS: 0.0000
Vendors: sanluan
Products: PublicCMS (5.*)

PublicCMS (4.*)

PublicCMS (6.*)
Aliases: GHSA-2xhq-9mxg-mc67

ENISA description: A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
Sanluan	PublicCMS	`4.` (affected), `5.` (affected), `6.*` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization vdb-entrytechnical-description
VDB-429652 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
CVE-2026-120319 | CVE Analysis and Report third-party-advisory
Submit #1016201 | Sanluan publiccms V5 Authorization Bypass third-party-advisory

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

CVE-2026-120319 | CVE Analysis and Report third-party-advisory
Submit #1016201 | Sanluan publiccms V5 Authorization Bypass third-party-advisory
VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization vdb-entry, technical-description
VDB-429652 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

CVEs and Security Vulnerabilities - OpenCVE

web:app.opencve.io

Explore the latest vulnerabilities and security issues in the CVE database

2026-11-02 13:20 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-02 13:20 UTC
CVE-2026-120319: Sanluan PublicCMS Authorization Bypass

web:cvetodo.com

CVE-2026-120319 is an Authorization Bypass vulnerability in Sanluan PublicCMS. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-11-02 13:20 UTC
CISA Requires Federal Agencies to Patch Critical Vulnerabilities Within ...

web:cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.

2026-11-02 13:20 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-02 13:20 UTC
CVE-2026-120319 - vulnerability database | Vulners.com

web:vulners.com

CVE-2026-120319 🗓️ 01 Nov 2026 17:15:23 Reported by VulDB Type cve 🔗 web.nvd.nist.gov 👁 8 Views

2026-11-02 13:20 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.

2026-11-02 13:20 UTC
Known Exploited Vulnerabilities Catalog - CISA

web:www.cisa.gov

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...

2026-11-02 13:20 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-11-02 13:20 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-02 13:20 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120319.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "publiccms-trade"
          ],
          "product": "PublicCMS",
          "vendor": "Sanluan",
          "versions": [
            {
              "status": "affected",
              "version": "4.*"
            },
            {
              "status": "affected",
              "version": "5.*"
            },
            {
              "status": "affected",
              "version": "6.*"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "s1mple_xy (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T01:15:23.883Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-429652 | Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/429652"
        },
        {
          "name": "VDB-429652 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/429652/cti"
        },
        {
          "name": "CVE-2026-120319 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-120319"
        },
        {
          "name": "Submit #1016201 | Sanluan publiccms V5 Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1016201"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-01T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-01T14:06:38.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-120319",
    "datePublished": "2026-11-02T01:15:23.883Z",
    "dateReserved": "2026-11-01T13:01:19.496Z",
    "dateUpdated": "2026-11-02T01:15:23.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}