https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 05:36:51 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111703 <p>yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users&#39; customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.</p> <p>yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users&#39; customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111703 https://db.gcve.eu/vuln/ghsa-wgfx-4ghc-w92f <p>yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users&#39; customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.</p> <p>yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users&#39; customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete customers, or release them into the public pool.</p> https://db.gcve.eu/vuln/ghsa-wgfx-4ghc-w92f