CVE-2026-119734

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119735

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119735

Munshi (by Petpooja) versions prior to 2026-07-13 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}) where malicious markup can be injected via item descriptions or messages. The root cause is ...

CVE-2026-119735 Munshi XSS via Purchase Inquiry Thread Rendering

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

EUVD-2026-115366

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

CVE-2026-119734

The Munshi platform (by Petpooja ) versions released before 2026-06-17 is affected by a broken object level authorization (IDOR) vulnerability. The flaw exists in the GET /purchase-inquiry/thread/{thread-id} endpoint, where authenticated attackers can manipulate the thread identifier to access da...

CVE-2026-119734 Munshi IDOR via Purchase Inquiry Thread Endpoint

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

EUVD-2026-115365

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119734: Petpooja Munshi: Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows…

Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...

CVE-2026-119735: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated…

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...