CVE-2026-116745 QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init that allows unauthenticated attackers to obtain guest order references and emails by supplying guest idcart values. Attackers can iterate sequential idcart values, read the Location redirec...

CVE-2026-116745

QloApps versions up to and including 1.7.0 are vulnerable to an information disclosure vulnerability within the OrderConfirmationController::init() function. Unauthenticated attackers can exploit this by providing guest id_cart values to obtain guest order references and emails. By iterating thro...