CVE-2026-121556

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

EUVD-2026-115901

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

CVE-2026-121556

Versions of FastBee up to and including 2.1.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability within the ProductController component. This flaw allows authenticated tenant users to access products belonging to other tenants by providing specific product IDs. By enumeratin...

CVE-2026-121556 FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

CVE-2026-121556 FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

CVE-2026-121556 FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

CVE-2026-121556: beecue FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows…

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...

CVE-2024-36837

CVE-2024-36837 / CNVD-2024-30128 POC write URL in url.txt and run CVE-2024-36837.py CVE-2024-36837 In my freshman year, I found that an educational institution used CRMEB Mall as an online store in an Internet protection action. After testing, sql injection vulnerability was found. After setting ...

CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605

The nopCommerce e-commerce platform, specifically versions before 5.00.0 , is vulnerable to a missing authorization flaw in the ProductController. The RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup handlers fail to verify the ownership of the parent product. This ...

EUVD-2026-111571

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-117605: nopSolutions nopCommerce: nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController…

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

PT-2026-127729

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

Nop Solutions nopCommerce authorization issue vulnerability

Nop Solutions nopCommerce versions prior to 5.00.0 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation in the RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup handlers within the admin ProductController. As ...

CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...

CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...