https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T00:47:11.956998+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-92458 CVE-2026-92458 — yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale 2026-10-01T00:47:11.972672+00:00

Affected: guchengwuyue yshop-crm

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.