P4Verified

CVE-2026-110608: BizSpring Shop affected git revisions; +1 more affected products

CVE-2026-110608. CVSS 3.1 base score 5.4 (GitHub Advisory Database).

Affected technology

BizSpring Shop · 0 through cf22d39daaf17f430d8fc1fb698a2f6e515e1808
BizSpring

BizSpring Java Mall · 0 through 369e88c5cda36ddcea56742c335ee1bfe50e8156
BizSpring

Description’s affected range: through commit cf22d39daaf1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as none; integrity and availability impact as low.

Published 14-Oct-2026 15:59 UTC

CWE: CWE-639
CCR priority: 21.6 /100 (P4)
CVSS 3.1: 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · GitHub Advisory Database
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-14 16:01:16.619248+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-14 15:56:36.793806+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-110608.html