https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 22:37:00 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110113 <p>PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members&#39; shipping addresses. Attackers can submit another member&#39;s sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.</p> <p>PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members&#39; shipping addresses. Attackers can submit another member&#39;s sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110113 https://db.gcve.eu/vuln/ghsa-vpf9-h2mx-wqjf <p>PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members&#39; shipping addresses. Attackers can submit another member&#39;s sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.</p> <p>PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members&#39; shipping addresses. Attackers can submit another member&#39;s sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.</p> https://db.gcve.eu/vuln/ghsa-vpf9-h2mx-wqjf