https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:04:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-368271 EUVD-2026-368271 https://cve.radiocsirt.org/vuln/euvd-2026-368271 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55795 <p>Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.</p> <p>Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55795 https://cve.radiocsirt.org/vuln/ghsa-h5gm-x9wr-vhcm <p><strong>Affected:</strong> Packagist: craftcms/commerce</p> <p>### Summary</p> <p>The CartController defines a RateLimiter behavior that is only activated when the &#39;number&#39; POST/GET parameter is explicitly provided.</p> <p>### Details</p> <p>When an attacker submits coupon codes against the session-based cart (without passing a &#39;number&#39; parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.</p> <p>**Vulnerable Code** &lt;img width=&#34;864&#34; height=&#34;90&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba&#34; /&gt;</p> <p>&lt;img width=&#34;881&#34; height=&#34;272&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd&#34; /&gt;</p> <p>&lt;img width=&#34;861&#34; height=&#34;271&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703&#34; /&gt;</p> <p>### PoC Complete instructions, including specific configuration details, to reproduce the vulnerability.</p> <p>&lt;img width=&#34;909&#34; height=&#34;171&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e&#34; /&gt;</p> <p>### Impact An attacker can enumerate all coupon codes through automated requests.</p> <p>**Remediation** Apply rate limiting unconditionally on actionUpdateCart regardless of whether &#39;number&#39; is present.</p> <p><strong>Affected:</strong> Packagist: craftcms/commerce</p> <p>### Summary</p> <p>The CartController defines a RateLimiter behavior that is only activated when the &#39;number&#39; POST/GET parameter is explicitly provided.</p> <p>### Details</p> <p>When an attacker submits coupon codes against the session-based cart (without passing a &#39;number&#39; parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.</p> <p>**Vulnerable Code** &lt;img width=&#34;864&#34; height=&#34;90&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba&#34; /&gt;</p> <p>&lt;img width=&#34;881&#34; height=&#34;272&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd&#34; /&gt;</p> <p>&lt;img width=&#34;861&#34; height=&#34;271&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703&#34; /&gt;</p> <p>### PoC Complete instructions, including specific configuration details, to reproduce the vulnerability.</p> <p>&lt;img width=&#34;909&#34; height=&#34;171&#34; alt=&#34;resim&#34; src=&#34;https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e&#34; /&gt;</p> <p>### Impact An attacker can enumerate all coupon codes through automated requests.</p> <p>**Remediation** Apply rate limiting unconditionally on actionUpdateCart regardless of whether &#39;number&#39; is present.</p> https://cve.radiocsirt.org/vuln/ghsa-h5gm-x9wr-vhcm