Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to…
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
Read at NIST National Vulnerability Database (CVE API 2.0)
- CVSS
- 7.1
Why it ranks 10 (Routine)
- CVSS 7.1 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-110119 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.