CVE-2026-110607 — BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentContro…
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7