Crmeb Crmeb Java vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Crmeb Crmeb Java: 2 record(s), with affected versions and fixes.
CVE-2026-111354
Low · 3.1
CWE-639 Oct 15, 2026
crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
CVE-2026-10771
High · 7.3
CWE-918 Jun 3, 2026
crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.