likeshop CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM likeshop CVE published 2026-10-15

CVE-2026-111348

CVE-2026-111348 is a vulnerability in Likeshop through version 3.5.1 that allows authenticated users to access other customers' after-sale records by supplying their IDs. This insecure direct object reference vulnerability exists in the AfterSale.php and AfterSaleLogic.php files, enabling attackers with self-registered accounts to perform various actions such as reading refund and order data, canceling re [truncated]