https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T01:34:45.114652+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116745 fkie_cve-2026-116745 2026-10-28T01:34:45.117104+00:00

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.

 https://db.gcve.eu/vuln/ghsa-g7m3-95cx-3cxg GHSA-g7m3-95cx-3cxg 2026-10-28T01:34:45.117443+00:00

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential id_cart values, read the Location redirect header, view booking details via guest-tracking, and convert guests into accounts with attacker-chosen passwords.