CVE-2026-110125

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110126

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/address...

CVE-2026-110127

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE...

CVE-2026-110127

The waynboot-mall software, versions through 2.0.0 , contains an Insecure Direct Object Reference (IDOR) vulnerability within the mobile CartController . The root cause allows authenticated members to access and manipulate other users' data by enumerating sequential cart IDs. Specifically, attack...

CVE-2026-110127 waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE...

CVE-2026-110126 waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/address...

CVE-2026-110126

The waynboot-mall application, versions through 2.0.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the AddressController . This flaw allows authenticated members to modify or delete shipping addresses belonging to other members. Attackers can exploit this by ...

CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110125

Waynboot-mall through version 2.0.0 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated members can access and modify the orders of other members by supplying specific order identifiers. By enumerating sequential order IDs or serial numbers, an attacker can i...

CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110125: Authorization Bypass Through User-Controlled Key

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm,...

CVE-2026-110127: Authorization Bypass Through User-Controlled Key

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE...

CVE-2026-110126: Authorization Bypass Through User-Controlled Key

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/address...