Vulnerability · Published Oct 11, 2026 · Assigned by VulDB

CVE-2026-108568InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

Medium 4.3

In plain English

A medium-severity insufficient verification of data authenticity in icms2 from InstantSoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.1%top 97.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
InstantSoft	icms2	2.18.02.18.12.18.2

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

References

VDB-416225 | InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity vdb-entry, technical-description
VDB-416225 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-108568 | CVE Analysis and Report third-party-advisory
Submit #954261 | InstantCMS InstantCMS icms2 2.18.2 Insufficient Verification of Data Authenticity third-party-advisory