Is CVE-2026-120319 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120319?

CVE-2026-120319 has a CVSS v3 severity of MEDIUM (6.3).

Back

CVE-2026-120319

Description

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.