Search
Find a vulnerability
Search criteria
4 vulnerabilities found for InnoShop by innocommerce
CVE-2026-108591 (GCVE-0-2026-108591)
Vulnerability from nvd – Published: 2026-10-10 18:16 – Updated: 2026-10-10 18:16
VLAI
EPSS
VEX
Title
InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
Summary
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
Severity
4.4 (Medium)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/innoshop-mcp-local-file-read | third-party-advisory |
| https://github.com/innocommerce/innoshop/blob/6af… | technical-description |
| https://github.com/innocommerce/innoshop/blob/6af… | technical-description |
| https://github.com/innocommerce/innoshop | product |
| https://www.vulncheck.com/advisories/innoshop-0.9… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| innocommerce | InnoShop |
Affected:
0.9.2 , ≤ 0.9.2
(semver)
|
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "InnoShop",
"repo": "https://github.com/innocommerce/innoshop",
"vendor": "innocommerce",
"versions": [
{
"lessThanOrEqual": "0.9.2",
"status": "affected",
"version": "0.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool\u0027s source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T18:16:55.939Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/innoshop-mcp-local-file-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/aicore/src/Tools/FileUploadTool.php#L55-L89"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/restapi/src/Services/UploadService.php#L33"
},
{
"tags": [
"product"
],
"url": "https://github.com/innocommerce/innoshop"
},
{
"name": "VulnCheck Advisory: InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/innoshop-0.9.2-local-file-disclosure-via-ai-core-mcp-file-upload-tool"
}
],
"title": "InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108591",
"datePublished": "2026-10-10T18:16:55.939Z",
"dateReserved": "2026-10-10T18:08:11.062Z",
"dateUpdated": "2026-10-10T18:16:55.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7630 (GCVE-0-2026-7630)
Vulnerability from nvd – Published: 2026-05-02 13:15 – Updated: 2026-05-04 13:12 X_Open Source
VLAI
EPSS
VEX
Title
innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication
Summary
A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-04 13:12 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/360576 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/360576/cti | signaturepermissions-required |
| https://vuldb.com/submit/806484 | third-party-advisory |
| https://github.com/innocommerce/innoshop/issues/314 | exploitissue-tracking |
| https://github.com/innocommerce/innoshop/issues/3… | issue-tracking |
| https://github.com/innocommerce/innoshop/commit/4… | patch |
| https://github.com/innocommerce/innoshop/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| innocommerce | InnoShop |
Affected:
0.6.*
Affected: 0.7.0 Affected: 0.7.1 Affected: 0.7.2 Affected: 0.7.3 Affected: 0.7.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T13:12:01.184969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T13:12:56.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Installation Endpoint"
],
"product": "InnoShop",
"vendor": "innocommerce",
"versions": [
{
"status": "affected",
"version": "0.6.*"
},
{
"status": "affected",
"version": "0.7.0"
},
{
"status": "affected",
"version": "0.7.1"
},
{
"status": "affected",
"version": "0.7.2"
},
{
"status": "affected",
"version": "0.7.3"
},
{
"status": "affected",
"version": "0.7.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "anch0r (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-02T13:15:13.485Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-360576 | innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/360576"
},
{
"name": "VDB-360576 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/360576/cti"
},
{
"name": "Submit #806484 | innocommerce innoshop \u003c= 0.7.3 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/806484"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/innocommerce/innoshop/issues/314"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/innocommerce/innoshop/issues/314#issuecomment-4357464458"
},
{
"tags": [
"patch"
],
"url": "https://github.com/innocommerce/innoshop/commit/45758e4ec22451ab944ae2ae826b1e70f6450dc9"
},
{
"tags": [
"product"
],
"url": "https://github.com/innocommerce/innoshop/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-01T16:33:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7630",
"datePublished": "2026-05-02T13:15:13.485Z",
"dateReserved": "2026-05-01T14:28:41.503Z",
"dateUpdated": "2026-05-04T13:12:56.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108591 (GCVE-0-2026-108591)
Vulnerability from cvelistv5 – Published: 2026-10-10 18:16 – Updated: 2026-10-10 18:16
VLAI
EPSS
VEX
Title
InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
Summary
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.
Severity
4.4 (Medium)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/innoshop-mcp-local-file-read | third-party-advisory |
| https://github.com/innocommerce/innoshop/blob/6af… | technical-description |
| https://github.com/innocommerce/innoshop/blob/6af… | technical-description |
| https://github.com/innocommerce/innoshop | product |
| https://www.vulncheck.com/advisories/innoshop-0.9… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| innocommerce | InnoShop |
Affected:
0.9.2 , ≤ 0.9.2
(semver)
|
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "InnoShop",
"repo": "https://github.com/innocommerce/innoshop",
"vendor": "innocommerce",
"versions": [
{
"lessThanOrEqual": "0.9.2",
"status": "affected",
"version": "0.9.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool\u0027s source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T18:16:55.939Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/innoshop-mcp-local-file-read"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/aicore/src/Tools/FileUploadTool.php#L55-L89"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/innocommerce/innoshop/blob/6af6a9744414d10d2f5aab516ed0b6c3045a2848/innopacks/restapi/src/Services/UploadService.php#L33"
},
{
"tags": [
"product"
],
"url": "https://github.com/innocommerce/innoshop"
},
{
"name": "VulnCheck Advisory: InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/innoshop-0.9.2-local-file-disclosure-via-ai-core-mcp-file-upload-tool"
}
],
"title": "InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108591",
"datePublished": "2026-10-10T18:16:55.939Z",
"dateReserved": "2026-10-10T18:08:11.062Z",
"dateUpdated": "2026-10-10T18:16:55.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7630 (GCVE-0-2026-7630)
Vulnerability from cvelistv5 – Published: 2026-05-02 13:15 – Updated: 2026-05-04 13:12 X_Open Source
VLAI
EPSS
VEX
Title
innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication
Summary
A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-04 13:12 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/360576 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/360576/cti | signaturepermissions-required |
| https://vuldb.com/submit/806484 | third-party-advisory |
| https://github.com/innocommerce/innoshop/issues/314 | exploitissue-tracking |
| https://github.com/innocommerce/innoshop/issues/3… | issue-tracking |
| https://github.com/innocommerce/innoshop/commit/4… | patch |
| https://github.com/innocommerce/innoshop/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| innocommerce | InnoShop |
Affected:
0.6.*
Affected: 0.7.0 Affected: 0.7.1 Affected: 0.7.2 Affected: 0.7.3 Affected: 0.7.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7630",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T13:12:01.184969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T13:12:56.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Installation Endpoint"
],
"product": "InnoShop",
"vendor": "innocommerce",
"versions": [
{
"status": "affected",
"version": "0.6.*"
},
{
"status": "affected",
"version": "0.7.0"
},
{
"status": "affected",
"version": "0.7.1"
},
{
"status": "affected",
"version": "0.7.2"
},
{
"status": "affected",
"version": "0.7.3"
},
{
"status": "affected",
"version": "0.7.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "anch0r (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-02T13:15:13.485Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-360576 | innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/360576"
},
{
"name": "VDB-360576 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/360576/cti"
},
{
"name": "Submit #806484 | innocommerce innoshop \u003c= 0.7.3 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/806484"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/innocommerce/innoshop/issues/314"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/innocommerce/innoshop/issues/314#issuecomment-4357464458"
},
{
"tags": [
"patch"
],
"url": "https://github.com/innocommerce/innoshop/commit/45758e4ec22451ab944ae2ae826b1e70f6450dc9"
},
{
"tags": [
"product"
],
"url": "https://github.com/innocommerce/innoshop/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-01T16:33:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "innocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7630",
"datePublished": "2026-05-02T13:15:13.485Z",
"dateReserved": "2026-05-01T14:28:41.503Z",
"dateUpdated": "2026-05-04T13:12:56.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}