CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

CVE-2026-111615

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

CVE-2026-111697

HUIZHI ChargeOS cloud through 3.0.9 is vulnerable to an Insecure Direct Object Reference (IDOR) in the hcp-mp MeController and OrderController components. The root cause is that these controllers trust client-supplied parameters, specifically userId, openId, and orderNumber. An attacker can explo...

CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

EUVD-2026-102988

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

EUVD-2026-103037

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

CVE-2026-111615

The Mall4cloud platform (versions through 4.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the multishop OrderController getOrderAddr handler. This vulnerability allows authenticated merchants to access the shipping addresses of buyers from other shops by enumerating auto...

CVE-2026-111615 Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

CVE-2026-111615 Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

PT-2026-116096

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...

PT-2026-116014

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/ord...

CVE-2026-110608

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-110608

The BizSpring Shop software (through commit cf22d39daaf1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the OrderController cancel and receive handlers. This flaw allows authenticated members to manipulate orders belonging to other members by providing a target orderId...

EUVD-2026-101236

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-110608: Authorization Bypass Through User-Controlled Key

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to...

CVE-2026-108696

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confir...

CVE-2026-108696

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confir...

CVE-2026-108696

CoreShop versions through 1.5.5 are vulnerable to an authorization bypass within the OrderController component. The flaw allows authenticated customers to perform actions on orders belonging to other customers by providing user-controlled IDs. Specifically, an attacker can confirm receipt of anot...