EUVD-2026-102492

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...

CVE-2026-111348

Likeshop versions through 3.5.1 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw within the AfterSale.php and AfterSaleLogic.php files. This vulnerability allows authenticated users to access other customers' after-sale records by providing specific IDs. Attackers using self-regi...

PT-2026-115292

Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.5.2 Description An insecure direct object reference issue exists in AfterSale.php and AfterSaleLogic.php. Authenticated users with self-registered accounts can access after-sale records of other customers by...