CVE-2026-8738: medium-severity vulnerability in Sanluan PublicCMS
Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.3%
A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Sanluan · PublicCMSpublic PoCs found — 1
cve_referencevulnplus-note.wetolink.com/share/ayeMf4xWK0ZZunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sanluan PublicCMS
In the same product, most dangerous first.
CVE-2026-3289MEDIUMSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalEPSS 0.8%CVE-2026-1111MEDIUMSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalEPSS 0.7%CVE-2026-1112MEDIUMSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationEPSS 0.4%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2024-11070MEDIUMSanluan PublicCMS Tag Type save cross site scriptingEPSS 0.4%CVE-2025-7953MEDIUMSanluan PublicCMS viewer.html redirectEPSS 0.4%