CVE-2026-1733

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1733
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1733.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1733
Published
2026-02-01T23:15:49.483Z
Modified
2026-03-14T12:47:13.984530Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /api/storeintegral/order/detail/:uni. The manipulation of the argument orderid leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Git / github.com/crmeb/crmeb

Affected ranges

Type
GIT
Repo
https://github.com/crmeb/crmeb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a24a96ab34b9fdda0276f084e26f65d5740c1846
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.6.3"
        }
    ]
}

Affected versions

v2.*
v2.6
v2.6.0
v4.*
v4.4.2
v4.4.4
v4.6.0
v4.7.0
v5.*
v5.2.0
v5.3.0
v5.4.0
v5.6.1
v5.6.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1733.json"