https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:05:53.483381+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-33590 cnvd-2020-33590 2026-10-08T08:05:53.550745+00:00 cnvd-2020-33590 https://cve.radiocsirt.org/vuln/euvd-2026-40278 EUVD-2026-40278 2026-10-08T08:05:53.550787+00:00 EUVD-2026-40278 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11007 fkie_cve-2020-11007 2026-10-08T08:05:53.550803+00:00

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.

 https://cve.radiocsirt.org/vuln/ghsa-w8rc-pgxq-x2cj GHSA-w8rc-pgxq-x2cj — Negative charge in shopping cart in Shopizer 2026-10-08T08:05:53.550834+00:00

Affected: Maven: com.shopizer:sm-core-model

### Impact Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total.

### Patches Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0

### Workarounds Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.

### References [Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) [Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html) [Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a) CVE Details below : [Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007) [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)

### Credits Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity master program supervised by Yassine Ilmi

 https://cve.radiocsirt.org/vuln/gsd-2020-11007 gsd-2020-11007 2026-10-08T08:05:53.550879+00:00 gsd-2020-11007