CVEvulnerability
CVE-2026-105573
2.1 LOW
Official page ↗
- Status
- Deferred
- Published
- 2026-10-06
- Last modified
- 2026-10-06
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 2.1 LOW — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-840
Description
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Related
Weakness · not in database (1)
References
- https://github.com/newbee-ltd/newbee-mall/ github.com
- https://github.com/newbee-ltd/newbee-mall/issues/127 github.com
- https://vuldb.com/cve/CVE-2026-105573 vuldb.com
- https://vuldb.com/submit/989313 vuldb.com
- https://vuldb.com/vuln/413632 vuldb.com
- https://vuldb.com/vuln/413632/cti vuldb.com