CVE-2026-116274

CVSS 4.3 (medium) · published 2026-10-26

A vulnerability has been found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-266, CWE-285

Source: NVD CVE-2026-116274

References

• https://github.com/riyuedeqi/jizhicms-order-idor
• https://vuldb.com/cve/CVE-2026-116274
• https://vuldb.com/submit/1011003
• https://vuldb.com/vuln/426303
• https://vuldb.com/vuln/426303/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.