Newbee Mall EUVD-2026-92931

Requires a valid authenticated low-privilege account on the target application (PR:L); the attacker then sends a request to /jshERP-boot/accountHead/updateAccountHeadAndDetail with a manipulated goodsCount argument against the Shopping Cart Quantity Handler. No user interaction, no special non-default configuration, and no elevated privileges are needed, but the authentication gate is the primary limiting factor and impact is bounded to business-logic/integrity corruption (no data theft, code execution, or service outage). No vendor patch is available, so all current deployments up to version 2.7.5 are affected.

This is a genuinely medium/low-priority issue despite being remotely reachable. The CVSS 4.0 vector (score 5.3) tells a consistent story: AV:N/AC:L make it remotely and easily reachable, but PR:L requires an authenticated low-privilege account, UI:N needs no victim interaction, and the impact is confined to VI:L (low integrity) with VC:N, VA:N - no confidentiality or availability consequence. This matches CWE-840 (business logic errors): manipulating the goodsCount argument corrupts application logic (e.g., cart quantity/pricing arithmetic) rather than compromising the host. The embedded E:P signals a proof-of-concept exploit, and POC availability is confirmed in the input (public GitHub issue), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated exploitation - POC availability must not be conflated with active exploitation. One notable data conflict: the input Tags label this 'Information Disclosure,' which contradicts the CVSS (VC:N = no confidentiality impact) and the CWE-840 business-logic classification - treat the 'Information Disclosure' characterization as inaccurate. Additionally, the affected file path '/jshERP-boot/accountHead/updateAccountHeadAndDetail' and the 'accountHead' ERP concept are atypical for the newbee-mall storefront project and resemble jshERP internals; this product/path mismatch should be verified against the vendor, as these VulDB-sourced entries sometimes mislabel the affected component. Net: a real but modest integrity-only logic flaw gated by authentication, not an urgent widespread threat.

An authenticated low-privilege user sends a crafted request to /jshERP-boot/accountHead/updateAccountHeadAndDetail tampering with the goodsCount value (for example a negative, zero, or oversized quantity) to force a business-logic error such as skewed cart totals or pricing. A public proof-of-concept exists (referenced via the vendor's GitHub issue tracker), and because the attack is network-based with low complexity and no user interaction, it can be repeated reliably once the attacker holds a valid account.