CVE-2026-113468mediumCWE-862

CVE-2026-113468: medium-severity vulnerability in TYPO3 Extension "TYPO3 Shop by coding.ms"

Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

Published

Follow this CVE+ Monitor Extension "TYPO3 Shop by coding.ms"

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.4%
from disclosure to weaponsame day
Published on NVDOct 20
1st PoCOct 20
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "TYPO3 Shop by coding.ms"
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — TYPO3 Extension "TYPO3 Shop by coding.ms"

In the same product, most dangerous first.

CVE-2026-112071MEDIUMBroken Access Control in extension "TYPO3 Shop by coding.ms" (shop)EPSS 0.4%