CVE-2026-111354: crmeb_java 0 through 3.1

Affected technology

crmeb_java · 0 through 3.1
crmeb

Description’s affected range: through 3.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines. Vendor/CNA’s CVSS 4.0 assessment (base score 2.3/10) rates confidentiality impact as low; integrity and availability impact as none.