CVE-2026-112285

A flaw was found in Thelia. A remote authenticated customer can bypass coupon usage limits to obtain unauthorized discounts. This issue occurs because promotional coupon usage is only recorded when an order is marked as paid rather than when it is placed. Consequently, an attacker can submit...

CVE-2026-114233

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions ORDERMGRVIEW, without ORDERMGRUPDATE or any role on the order, to modify approved orders, changing a ship group's shipping...

EUVD-2026-117523

Missing check for ORDERMGRUPDATE in ordermgr allows user with only ORDERMGRVIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

EUVD-2026-117517

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions ORDERMGRVIEW, without ORDERMGRUPDATE or any role on the order, to modify approved orders, changing a ship group's shipping...

CVE-2026-107773

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, in versions prior to 5.3.3 , contains an authorization vulnerability. The plugin fails to correctly verify permissions when serving single orders and their associated notes. This allows unauthenticated attackers ...

CVE-2026-121628

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...

CVE-2026-121628 Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting

Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked timesused checks to...

CVE-2026-121628

The Bagisto e-commerce platform, specifically versions before 2.3.16 and 2.4.x before 2.4.1 , is vulnerable to a race condition in the manageCartRule() function. This flaw allows an attacker to bypass times_used checks by submitting concurrent order requests to the one-page orders checkout endpoi...

CVE-2025-67261

CVE-2025-67261 - Content-based blind SQL injection on Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. The "Search" function under the "Orders" page...

CVE-2026-111578

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-sli...

CVE-2026-119656 CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...

CVE-2026-119558

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handle...

EUVD-2026-113823

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handle...

EUVD-2026-113729

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary...

CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...

CVE-2026-119558: OpenCart: OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid…

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handle...

PT-2026-133496

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handle...

CVE-2026-118757

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

CVE-2026-118757

The PiWeb Disable payment method / Partial payment for WooCommerce plugin (versions before 1.1.10.9 ) is vulnerable to a missing authorization flaw in the update_fees AJAX handler. This allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own o...