DJ-Classifieds EUVD-2026-115360

Exploitation requires an authenticated session on the target site, but of any role - the description confirms 'any logged-in user, regardless of role.' On a public classifieds installation that permits self-registration, this is a low bar. The attacker invokes the 'duplicate my ad' convenience feature on the new-ad form (site/models/additem.php) and supplies another advert's raw numeric ID; no special configuration, non-default mode, or user interaction is needed, as the feature is part of the standard new-ad workflow. Exploitation is further eased because advert IDs are small sequential integers, enabling trivial enumeration, and because no publication-state check exists, so even blocked, pending, or never-published drafts are exposed. The only limiting factor is the required low-privileged authentication (PR:L); impact is confined to reading seller content/PII - there is no write, modification, or availability effect.

This is a genuine but moderate-severity information-disclosure issue, not a critical emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, requires a low-privileged authenticated account, no user interaction, confidentiality-only impact with no integrity or availability effect. The vuln.today decision label is 'this_month' - a routine patch priority, not act_now/emergency - which aligns with the medium CVSS. No EPSS score was provided, this CVE is not on CISA KEV, and the only reference is the vendor product page (not a working exploit), so exploitation status is 'no public exploit identified at time of analysis.' The main factors that raise real-world risk above the raw score are that advert IDs are small sequential integers (trivial enumeration), any logged-in user of any role suffices, and the exposed data is seller PII (phone, address, email) plus unpublished/pending drafts - so the confidentiality impact arguably leans toward the higher end of 'Low,' potentially High for the affected sellers. No signals conflict; the limiting factor is simply that an authenticated account is required, which gates mass untargeted abuse but is a low bar on a public classifieds site that permits self-registration.

An attacker registers or uses any ordinary logged-in account on a site running DJ-Classifieds and opens the 'duplicate my ad' new-ad form, passing another user's advert ID in place of their own. Because additem.php loads the advert by raw numeric ID without an ownership or publication-state check, the attacker receives the full ad content - including the seller's phone number, address, email, and price - even for ads that were never published. Since advert IDs are small sequential integers, the attacker can script enumeration to harvest PII across all accounts; no public exploit code is required as the technique is described in the advisory.