CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...

CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...

CVE-2026-111277

NivoCart versions through 2.5.1 are vulnerable to a missing authorization vulnerability in the download() action of the account/order component. Unauthenticated attackers can exploit this by supplying a specific order_id to retrieve guest order invoices. By iterating the order_id parameter, attac...

CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...

CVE-2026-55383

Prior to version 2.4.0 , the InvoiceShelf web & mobile app is vulnerable to a token type confusion issue. The application fails to verify the mailable_type when processing numeric mailable_id values from EmailLog tokens on public routes for invoices, estimates, and payments. Additionally, the JSO...

CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

CVE-2026-13612 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...