Threats tagged 'ghsa-wgfx-4ghc-w92f'

1 threat

Threats tagged 'ghsa-wgfx-4ghc-w92f'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.2%	CVE-2026-111703yshop-crm · Authorization Bypass Through User-Controlled Key Medium5.3EPSS 0.2%2026-10-16CVE Database V5CVE-2026-111703 yshop-crm versions up to 2.1.3 contain an insecure direct object reference vulnerability that allows authenticated sales users to access, modify, or delete other users' customer records by supplying arbitrary IDs. This affects the get, update, delete, and do-open endpoints, enabling unauthorized enumeration and manipulation of customer data. EPSS 0.2%Vulnerability guchengwuyue #ghsa-wgfx-4ghc-w92f	CVE Database V5	2026-10-16

Showing 1–1 of 1 result