https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-14T21:26:58.538006+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-110120 fkie_cve-2026-110120 2026-10-14T21:26:58.597087+00:00

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.

 https://db.gcve.eu/vuln/ghsa-q3pp-r67w-8848 GHSA-q3pp-r67w-8848 2026-10-14T21:26:58.597206+00:00

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.