https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 07:02:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115326 <p>QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers&#39; service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims&#39; service lines, and corrupt refund quantities.</p> <p>QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers&#39; service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims&#39; service lines, and corrupt refund quantities.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115326 https://db.gcve.eu/vuln/ghsa-7cwv-h2vr-67q3 <p>QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers&#39; service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims&#39; service lines, and corrupt refund quantities.</p> <p>QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers&#39; service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims&#39; service lines, and corrupt refund quantities.</p> https://db.gcve.eu/vuln/ghsa-7cwv-h2vr-67q3