CVE-2026-110113

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

CVE-2026-110113 PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

CVE-2026-110113

PublicCMS versions through V6.202608.a are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the TradeAddressController tradeAddress/save handler. The root cause is a failure to verify ownership by the session user and site, allowing authenticated members to modify oth...

EUVD-2026-98944

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

CVE-2026-110113 PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to...

PT-2026-111705

Name of the Vulnerable Software and Affected Versions PublicCMS versions prior to V6.202608.a Description An insecure direct object reference issue exists in the tradeAddress/save handler of the TradeAddressController. This flaw allows authenticated members to modify the shipping addresses of oth...