Extension "Typo3 Shop By Coding.Ms"
Approved changes feed: RSS · Atom
cpe:2.3:a:typo3:extension_"typo3_shop_by_coding.ms":*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Typo3 (bebcd01c-0947-5641-89ed-9b814cca944e) |
|---|---|
| Product | Extension "Typo3 Shop By Coding.Ms" (2bae5d1a-fb5a-5ccd-926e-260f3d4e79fd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-112071 |
vulnerable | 2026-11-03 10:16:28.236464 |
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Published: 2026-10-20T09:30:47.669Z
Updated: 2026-10-20T15:44:57.053Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113468 |
vulnerable | 2026-11-03 10:16:27.505955 |
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Published: 2026-10-20T09:30:46.881Z
Updated: 2026-10-20T15:45:26.410Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.