https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-14T19:04:45.305975+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110120 CVE-2026-110120 — yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController 2026-10-14T19:04:45.307099+00:00

Affected: guchengwuyue yshopmall

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.