CVE-2024-46532

CVE number: CVE-2024-46532 vendor: Shanghai Dingxiang Information Technology Co., Ltd.https://www.kancloud.cn/ product: Internet Medical System Medical Outpatient OpenHIS version: V1.0 affected component: https://github.com/1638824607/OpenHIS?tab=readme-ov-file Reproduction of SQL Injection...

CVE-2022-4047

CVE-2022-4047 Return Refund and Exchange For WooCommerce 4.0.9 - Unauthenticated Arbitrary File Upload Usage @@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@ @@@@@@@@ @@@ @@@@@@@@ @@@@@@@@ @@@ @@@ @@@@@@@@ @@@@@@@@ @@@@@@@@@@ @@@@@@@@ @@@@@@@@ @@@@ @@@@@@@@@@ @@@@ @@@@@@@@ !@@ @@! @@@ @...

WooRefer

WooRefer | CVE-2022-4047 - Return Refund and Exchange For WooCommerce Automatic Mass Tool for check and exploiting vulnerability in CVE-2022-4047 - Return Refund and Exchange For WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How T...

CVE-2026-101273

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged ...

CVE-2026-101273 Giftcard enumeration

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged ...

CVE-2026-101273

The Pretix platform is affected by a gift card enumeration vulnerability. Certain API endpoints fail to validate auto-incremented internal IDs when creating order payments, allowing an attacker to reference gift cards belonging to different organizers. This flaw enables the retrieval of secret ke...

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.10 bsc1255111: CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. CVE-2026-111943:...

CVE-2026-115326

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...

CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...

CVE-2026-115326

QloApps versions through 1.7.0 are affected by an insecure direct object reference (IDOR) vulnerability in the OrderDetailController::displayAjaxSubmitRefundRequest() function. This flaw allows authenticated customers to submit refund requests for service lines belonging to other customers by pro...

CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...

EUVD-2026-108128

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign idserviceproductorderdetail values with...

PT-2026-121364

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id service product order detail values...

OPENSUSE-SU-2026:22152-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

SUSE-SU-2026:24359-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

QloApps authorization issue vulnerability

QloApps versions 1.7.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references within OrderDetailController::displayAjaxSubmitRefundRequest. It may allow authenticated customers to submit the idserviceproductorderdetail values of oth...

CLEANSTART-2026-XA13767 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-VR65122 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

EUVD-2026-102498

crmebjava through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/orderId or /api/front/order/apply/refund/orderId to view victims' tracking numbers,...

EUVD-2026-102492

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...