cyfenced.com →

[ CVE-2026-110120 · Published 13 Oct 2026 ]

Vulnerability in guchengwuyue yshopmall

CVSS 5.4 EPSS <1%No fix listed yet

[ Description ]Official description

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References