An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36235.json"