CVE-2026-90598

Publié : 13 septembre 2026

Modifié : 13 septembre 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypass. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The pull request to fix this issue awaits acceptance.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/jaygajera17/E-commerce-project-springBoot/https://github.com/jaygajera17/E-commerce-project-springBoot/issues/172 https://github.com/jaygajera17/E-commerce-project-springBoot/pull/174 https://github.com/user-attachments/files/30648539/poc_idor_updateuser.py https://vuldb.com/cve/CVE-2026-90598 https://vuldb.com/submit/913792 https://vuldb.com/vuln/403180 https://vuldb.com/vuln/403180/cti

Dernières Vulnérabilités

CVE-2026-90599

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

VOIR DÉTAILS

CVE-2026-90597

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

VOIR DÉTAILS

CVE-2026-90596

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is possible to be carried out remotely. Upgrading the affected component is recommended. The project was informed of the problem early through an issue report but has not responded yet.

VOIR DÉTAILS