CVE-2026-106676

— UNSCOREDpublic exploit available

Published 2026-10-26 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

Public exploit & PoC references

https://github.com/qiujie/mall
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md

All references

https://github.com/qiujie/mall
https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-106676.md

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.