https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 20:55:53 +0000 https://db.gcve.eu/vuln/cve-2026-111611 <p><strong>Affected:</strong> roncoo-education</p> <p>roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users&#39; orders. Attackers can supply another user&#39;s order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.</p> <p><strong>Affected:</strong> roncoo-education</p> <p>roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users&#39; orders. Attackers can supply another user&#39;s order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.</p> https://db.gcve.eu/vuln/cve-2026-111611