EUVD-2026-102492

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop versions through 3.5.1 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the AfterSale.php and AfterSaleLogic.php files. This vulnerability allows authenticated users to access other customers' after-sale records by providing specific IDs. Attackers using self-regi...

CVE-2026-111348: Authorization Bypass Through User-Controlled Key

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

PT-2026-115292

Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.5.2 Description An insecure direct object reference issue exists in AfterSale.php and AfterSaleLogic.php. Authenticated users with self-registered accounts can access after-sale records of other customers by...

Likeshop authorization issue vulnerability

Likeshop 3.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in AfterSale.php and AfterSaleLogic.php. Attackers can access other customers’ after-sales records by providing user IDs, thereby enabling them to read...