EUVD-2026-54497
GHSA-q68v-x5p2-qf6h
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with no authentication required, but high complexity limits opportunism; only low integrity impact applies with no confidentiality or availability effects.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the WonderTrader TraderDD service (AV:N per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 captures a medium-severity finding with a network attack vector but high complexity (AC:H), meaning exploitation is not straightforward and likely requires precise timing, specific session state, or particular system conditions beyond the attacker's control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version is confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wondertrader
View allUse of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause li
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to man
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today