CVE-2026-110114

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared...

CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-110122 PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id...

CVE-2026-110121

PickMall lilishop versions through 4.4 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) within the goods update endpoint. Authenticated sellers can exploit this by sending PUT requests to /store/goods/goods/update/{goodsId} using a goodsId belonging to a differ...

CVE-2026-110122

PickMall lilishop (through version 4.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The issue resides in the GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight methods, which update goods and SKUs by ID without performing necessary store-scoped checks . This ...

CVE-2026-110114 oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared...

CVE-2026-110114 oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints

FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared...

EUVD-2026-92450

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775: Authorization Bypass Through User-Controlled Key

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

PT-2026-106010

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-93771

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93771

The Cost of Goods for WooCommerce plugin for WordPress, in versions

CVE-2026-93771 WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93771 WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

EUVD-2026-89829

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

CVE-2026-93771: Deserialization of Untrusted Data

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

PT-2026-103161

Shop manager PHP Object Injection in Cost of Goods for WooCommerce = 3.5.2 versions...

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cost of Goods for WooCommerce versions = 3.5.2...

EUVD-2026-87897

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization...