Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: BizSpring Clear all filters
TI-2026-74102 CVE-2026-110608 · GHSA-p242-36gv-prqq

Insecure direct object reference in BizSpring Shop order handling

Priority LOW 24

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders b…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.004 Published 2026-10-14 No fix listed CWE-639
TI-2026-74101 CVE-2026-110607 · GHSA-r6p5-w7hv-x5rq

Payment verification bypass in BizSpring Shop lets buyers skip payment

Priority MEDIUM 64

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00305 Published 2026-10-14 No fix listed CWE-345