CVE-2026-119558
Low · 3.1CVSS
3.1
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115248 A vulnerability was detected in subhajitkhan online-clinic-management-system up to… CWE-841
- CVE-2026-87503 Inappropriate implementation in Downloads in Google Chrome on on Android prior to… CWE-841
- CVE-2026-53637 Sylius is an Open Source eCommerce Framework on Symfony. CWE-841
- CVE-2026-82423 A vulnerability has been found in macrozheng mall up to 1.0.3. CWE-841
- CVE-2026-55763 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-841
- CVE-2026-78618 A business logic flaw in WatchGuard Dimension allows an authenticated administrator to… CWE-841
- CVE-2026-78103 WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. CWE-841
- CVE-2026-77508 Weblate is a web based localization tool. CWE-841