CVE-2026-86263

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

CVE-2026-86263 sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

EUVD-2026-72240

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

CVE-2026-86263 sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

CVE-2026-86263

sfturing hosp_order is a Java-based hospital order management application. The vulnerability affects the Order Cancellation component, specifically the orderRecordsService.cancelOrder function in ssm_pro/src/main/java/cn/sfturing/web/OrderController.java. Manipulation of the ID argument enables a...

PT-2026-86619

A vulnerability was detected in sfturing hosp order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argumen...

CVE-2026-86263: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

PT-2026-79305

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

EUVD-2026-46409

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

PT-2026-62100

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

PT-2026-60989

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error message GET parameter is passed directly to wc add notice in flowpayment-fl.php lines 57-58 withou...

CVE-2026-9028 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers t...

CVE-2026-9028

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-9028 CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers t...

PT-2026-55756

A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel order of the file classes/Master.php. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit...

CVE-2025-14843

The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, and including, 1.2.9. This is due to a lack of authentication and authorization checks in the 'handlecheckoutredirecturlresponse' function. This makes it...