CVE-2026-110120

The Yshopmall software, through version 2.0.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the after-sales API . Authenticated members can access, tamper with, or delete other members' after-sales records by supplying an after-sales id and orderCode . Specifi...

CVE-2026-110120 yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET...