CVE-2026-81194

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability

Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

CVE-2026-13153 Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-30573

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 . The flaw is located in the add-sales.php file, where the application fails to validate the "txtprice" and "txttotalcost" parameters. This lack of input validation allows attackers to submit negative v...

POS Codekop 访问控制错误漏洞

POS Codekop is an application. A security vulnerability exists in POS Codekop version v2.0 that stems from a corrupted authentication mechanism that allows an unauthenticated attacker to download sales data...

编号撤回

InventoryManagementSystem is an inventory management system by Sajan Rajbhandari, an individual developer. Provides an easy way to track products, suppliers, customers, and purchasing and sales information. This CVE number has been withdrawn...

Valve: Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/

The Steamworks Product Data web site had an URL route with insufficient access controls, which would allow an authenticated partner to view data for games which they might not otherwise have permissions to view. After mitigation, an audit of accesses to this URL route showed no accesses by partie...

Unspecified Vulnerability in Oracle Hospitality Reporting and Analytics (CNVD-2019-36657)

Oracle Hospitality Reporting and Analytics is a web-based application that centralizes point-of-sale POS data, provides operational and analytical insights into business operations, and improves efficiencies by delivering information to all roles within an organization. An unspecified vulnerabili...

breednet.com.au XSS vulnerability

Open Bug Bounty ID: OBB-558120 Description| Value ---|--- Affected Website:| breednet.com.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Zomato: [www.zomato.com] Unauthenticated access to Internal Sales Data of Zomato through an unrestricted endpoint

Internal sales dashboard was open. While running through the JS file I discovered a new endpoint, while reading further I found that it shouldn't have been accessible by anyone else apart from the admin. So, I started to find the correct Post Request and within few mins of fuzzing, I found the...