CVE-2026-116274
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Oct 26, 2026
CISA due date
—
The record
A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121539 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. CWE-266
- CVE-2026-121514 A weakness has been identified in EasySoft ZenTao PMS up to 22.6. CWE-266
- CVE-2026-119922 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5… CWE-266
- CVE-2026-120224 A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. CWE-266
- CVE-2026-120185 A security flaw has been discovered in ken678 YznCMS up to 2.2.0. CWE-266
- CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
- CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
- CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266