CVE-2026-110125

MediumCVSS 6.3/10Last modified Oct 16, 2026

Description

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1101265.4waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated member CVE-2026-1101274.3waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticate CVE-2026-1101287.5fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's CVE-2026-1101296.5fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail CVE-2026-110136.5Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised CVE-2026-11013010.0Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-CVE-2026-1101315.3ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allow CVE-2026-1101357.4The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, becaus CVE-2026-1101369.6Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a CVE-2026-1101378.8Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1101388.3Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process CVE-2026-1101398.8Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a