CVE-2026-115450

The MarcosCamara01 Ecommerce Template contains a price manipulation vulnerability (CWE-472 ) within its cart and checkout flow. The POST /api/user/cart endpoint independently accepts variantId (used for order records) and stripeId (used for Stripe charges) without verifying their association. An ...