CVE-2026-105573 - Vulnerability Details

- newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error

Description

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-10-06

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Shopping Cart Quantity Handler at /jshERP-boot/accountHead/updateAccountHeadAndDetail allows manipulation of the goodsCount parameter leading to business logic errors. The vulnerability can cause incorrect processing of quantity updates, potentially allowing unauthorized changes to cart data or inventory.

Affected Systems

Products impacted are newbee-ltd's newbee-mall with versions up to and including 2.7.5. The affected component is the Shopping Cart Quantity Handler, specifically the updateAccountHeadAndDetail function referenced in the documentation.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so precise exploitation probability is unknown, but the public disclosure and remote attack initiation suggest that the flaw could be exploited over a network. The issue has not been addressed by the vendor, and the vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

newbee-ltd

newbee-mall

affected

Version	Status	Constraints
`2.7.0`	affected	—
`2.7.1`	affected	—
`2.7.2`	affected	—
`2.7.3`	affected	—
`2.7.4`	affected	—
`2.7.5`	affected	—

No data.

Vendor Product Confidence Versions

Newbee-ltd

Newbee-mall

95%

Version	Status	Scheme	Platform
`2.7.0`	affected	semver	—
`2.7.1`	affected	semver	—
`2.7.2`	affected	semver	—
`2.7.3`	affected	semver	—
`2.7.4`	affected	semver	—
`2.7.5`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest release of newbee-mall that includes a fix for the updateAccountHeadAndDetail logic error or apply a vendor-provided patch.
Validate the goodsCount input rigorously on the server side, ensuring it is an integer within the acceptable range before processing the request.
Restrict access to the /jshERP-boot/accountHead/updateAccountHeadAndDetail endpoint to authenticated users with appropriate permissions and employ rate limiting to mitigate repetitive exploitation attempts.
Monitor logs for anomalous quantity update requests and investigate any suspicious activity.

Generated by OpenCVE AI on October 6, 2026 at 04:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00229.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/newbee-ltd/newbee-mall/
https://github.com/newbee-ltd/newbee-mall/issues/127
https://vuldb.com/cve/CVE-2026-105573
https://vuldb.com/submit/989313
https://vuldb.com/vuln/413632
https://vuldb.com/vuln/413632/cti

History

Tue, 10 Nov 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 03:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error
First Time appeared		Newbee-ltd Newbee-ltd newbee-mall
Weaknesses		CWE-840
CPEs		cpe:2.3:a:newbee-ltd:newbee-mall::::::::
Vendors & Products		Newbee-ltd Newbee-ltd newbee-mall
References		https://github.com/newbee-ltd/newbee-mall/ https://github.com/newbee-ltd/newbee-mall/issues/127 https://vuldb.com/cve/CVE-2026-105573 https://vuldb.com/submit/989313 https://vuldb.com/vuln/413632 https://vuldb.com/vuln/413632/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Newbee-ltd Newbee-mall

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-06T02:45:08.248Z

Updated: 2026-10-06T17:40:40.951Z

Reserved: 2026-10-05T16:11:33.436Z

Link: CVE-2026-105573

Vulnrichment

Updated: 2026-10-06T17:05:52.904Z

NVD

Status : Deferred

Published: 2026-10-06T03:17:01.033

Modified: 2026-10-06T18:16:45.803

Link: CVE-2026-105573

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-06T04:30:19Z

Weaknesses

CWE-840

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object