All vulnerabilities
CVE-2026-110607

BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint

BizSpring BizSpring Shop
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.

Text from CVE List

Affected versions 2

  • BizSpring Shopaffected: all versions through cf22d39daaf17f430d8fc1fb698a2f6e515e1808CVE List
  • BizSpring Java Mallaffected: all versions through 369e88c5cda36ddcea56742c335ee1bfe50e8156CVE List

References 8