CVE-2025-52920

Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID.

• CWE-425

• https://github.com/innocommerce/innoshop
• https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f

Published

Jun 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52915K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware…7.2
• CVE-2025-52916Yealink RPS before 2025-06-04 lacks SN verification attempt …2.2
• CVE-2025-52917The Yealink RPS API before 2025-05-26 lacks rate limiting, p…4.3
• CVE-2025-52918Yealink RPS before 2025-05-26 does not prevent OpenAPI acces…5
• CVE-2025-52919In Yealink RPS before 2025-05-26, the certificate upload fun…4.3
• CVE-2025-5292The Element Pack Addons for Elementor – Best Elementor addon…6.4
• CVE-2025-52921In Innoshop through 0.4.1, an authenticated attacker could e…9.9
• CVE-2025-52922Innoshop through 0.4.1 allows directory traversal via FileMa…7.4
• CVE-2025-52923Sangfor aTrust through 2.4.10 allows users to modify the Exe…4.3
• CVE-2025-52924In One Identity OneLogin before 2025.2.0, the SQL connection…4
• CVE-2025-52925In One Identity OneLogin Active Directory Connector before 6…5
• CVE-2025-52926In scan.rs in spytrap-adb before 0.3.5, matches for known st…2.7