CVE-2026-110119

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-110128.3Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proceCVE-2026-1101205.4Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members CVE-2026-1101216.5PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any CVE-2026-1101224.3PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other sCVE-2026-1101237.1Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS coCVE-2026-1101248.1FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilegeCVE-2026-1101256.3Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modifCVE-2026-1101265.4waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated memberCVE-2026-1101274.3waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticateCVE-2026-1101287.5fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's CVE-2026-1101296.5fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail CVE-2026-110136.5Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised
CVE-2026-110119: High severity, CVSS 7.1 | Vulnix