Ikas E Commerce Infrastructure
Monthly
Account enumeration in ikas E-Commerce Infrastructure (all versions through 2026-07-13) allows unauthenticated remote attackers to determine whether a given customer account exists by observing distinguishable responses from authentication-related endpoints such as login, registration, or password reset. The flaw is reached remotely with low complexity and no user interaction, but only discloses account existence rather than credentials or data, and no public exploit code has been identified at time of analysis. Note that the input score of 7.5 (HIGH) assumes a high confidentiality impact, whereas the assessed vector (C:L, no I/A) reflects a more limited information-disclosure impact typical of username enumeration; treat the exposure as a reconnaissance enabler for credential stuffing and phishing rather than as direct system compromise.
Account enumeration in ikas E-Commerce Infrastructure (all versions through 2026-07-13) allows unauthenticated remote attackers to determine whether a given customer account exists by observing distinguishable responses from authentication-related endpoints such as login, registration, or password reset. The flaw is reached remotely with low complexity and no user interaction, but only discloses account existence rather than credentials or data, and no public exploit code has been identified at time of analysis. Note that the input score of 7.5 (HIGH) assumes a high confidentiality impact, whereas the assessed vector (C:L, no I/A) reflects a more limited information-disclosure impact typical of username enumeration; treat the exposure as a reconnaissance enabler for credential stuffing and phishing rather than as direct system compromise.