Is there a public PoC exploit available for CVE-2026-8738?

Yes, a public proof-of-concept exploit is available for CVE-2026-8738. Prioritise patching immediately. EPSS: 0.0%.

PublicCMS CVE-2026-8738

Q: What is the CVSS score of CVE-2026-8738?

CVE-2026-8738 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30688 MEDIUM

Business Logic Errors (CWE-840)

2026-05-17 VulDB

GHSA-9g77-xx5j-qgfr

Java Information Disclosure

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 17, 2026 - 08:30 vuln.today

CVSS changed

May 17, 2026 - 08:22 NVD

6.5 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Business logic flaws in PublicCMS 5.202506.d trade payment controller allow unauthenticated remote attackers to manipulate payment processing workflows, potentially enabling payment bypass or unauthorized transaction modifications. Publicly available exploit code exists demonstrating the attack. The vulnerability affects three payment-related functions (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) in the publiccms-trade module. Vendor was notified but did not respond, and no patch has been announced.

Technical ContextAI

PublicCMS is a Java-based content management system with e-commerce capabilities. This vulnerability affects the trade payment flow module (publiccms-trade), specifically three payment controller functions. The root cause is CWE-840 (Business Logic Errors), indicating flawed state management or validation in the payment processing workflow rather than a traditional injection or memory corruption vulnerability. Java-based payment flows typically involve multi-step processes (cart → order → payment gateway → confirmation), and business logic errors can allow attackers to manipulate transaction states, amounts, or payment statuses by sending requests out of sequence or with crafted parameters. The affected CPE (cpe:2.3:a:sanluan:publiccms:*:*:*:*:*:*:*:*) indicates the Sanluan vendor's PublicCMS product is impacted, with version 5.202506.d specifically identified.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond to the disclosure. Organizations must implement compensating controls: (1) Disable the PublicCMS trade/payment module entirely if e-commerce functionality is not business-critical (eliminates attack surface but removes payment features). (2) Implement strict server-side payment state validation independent of client inputs - verify each payment workflow step server-side against expected state machine transitions, reject out-of-sequence requests (adds latency to payment processing, requires custom code). (3) Deploy web application firewall (WAF) rules to detect anomalous payment API access patterns, such as repeated calls to payment endpoints without corresponding order creation (may cause false positives during legitimate retries). (4) Enable comprehensive payment transaction logging and real-time monitoring for payment amount mismatches or status inconsistencies (detective control, not preventive). (5) Restrict network access to trade controller endpoints to known client IP ranges if architecture permits (breaks mobile/dynamic IP users). Monitor https://vuldb.com/vuln/364326 and Sanluan's official channels for patch announcements. Consider migrating to actively maintained CMS platforms if vendor remains non-responsive, as payment security flaws pose significant fraud risk.