https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T07:13:08.845250+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111354 CVE-2026-111354 — crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints 2026-10-20T07:13:08.846568+00:00

Affected: crmeb_java

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.