Wondertrader
Monthly
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.
Behavioral workflow enforcement bypass in WonderTrader up to version 0.9.9 allows remote low-privileged attackers to manipulate the getUndoneQty argument within the _undone_qty function of the Pending Order Handler component (src/WtCore/TraderAdapter.h), resulting in unauthorized integrity modification of pending order state. The CVSS 4.0 vector confirms network-accessible exploitation with low privilege requirements and no user interaction. A publicly available proof-of-concept exploit exists (E:P), though no CISA KEV listing is recorded. The vendor was notified prior to disclosure and did not respond, meaning no official patch or advisory has been released.
Use of an uninitialized variable in WonderTrader up to version 0.9.9 allows a remote low-privileged attacker to cause limited availability disruption by manipulating the m_offsetType argument within the TraderATP Cash Trade Conversion component. The flaw resides in src/Includes/WTSTradeDef.hpp and is exploitable remotely, with a public proof-of-concept available via a Feishu document. No patch has been released and the vendor has not responded to disclosure - exploitation conditions are low complexity once authentication is satisfied, making this a persistent unmitigated risk for deployments using the ATP cash trading interface.
Improper behavioral workflow enforcement in WonderTrader up to version 0.9.9 allows remote attackers to manipulate the FID_JYLB argument in the TraderDD::queryTrades function, causing the application to execute trading query operations in an unintended sequence. Per the CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N), exploitation is network-reachable without authentication but requires high attack complexity, limiting opportunistic abuse. A proof-of-concept exploit is publicly available (E:P), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis.