CVE-2026-116274 | JIZHICMS up to 2.5.6 Front-end Order OrderController.php pay orderno improper authorization

October 25, 2026 Yanac

A vulnerability, which was classified as problematic, was found in JIZHICMS up to 2.5.6. This affects the function Pay of the file app/home/c/OrderController.php of the component Front-end Order Handler. Such manipulation of the argument orderno leads to improper authorization.

This vulnerability is uniquely identified as CVE-2026-116274. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More