Medium severity · published Feb 6, 2026
CVE-2026-2010
Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization
4.2
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulation of the argument paymentId leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 7329437e1288540336b1c66c114ed3363adcba02. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
PublicCMS · Sanluan
4.0.202506.a; 4.0.202506.b; 4.0.202506.c; 4.0.202506.d; 5.202506.a; 5.202506.b; +6 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2010
Product
https://github.com/sanluan/PublicCMS/
Patch
https://github.com/sanluan/PublicCMS/commit/7329437e1288540336b1c66c114ed3363adcba02
Exploit
https://github.com/sanluan/PublicCMS/issues/108
Exploit
https://github.com/sanluan/PublicCMS/issues/108#issue-3838143772
Permissions Required
https://vuldb.com/?ctiid.344592
Third Party Advisory
https://vuldb.com/?id.344592
More from PublicCMS
9.8
CVE-2026-3289
Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal
9.8
CVE-2025-25361
An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a…
9.8
CVE-2023-46990
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function
9.8
CVE-2023-34852
PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions
9.8
CVE-2020-20914
SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter