Vulnerabilidades de Macrozheng

CVE-2026-109410 Baixa · 2.4 CWE-682 13/10/2026

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the...

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

CVE-2026-109407 Baixa · 3.1 CWE-362 13/10/2026

macrozheng mall Coupon Redemption generateOrder race condition

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/generateOrder of the component Coupon Redemption. Such manipulation of the argument couponId leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation.

CVE-2026-109406 Média · 5.4 CWE-840 13/10/2026

macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

CVE-2026-108785 Média · 6.3 CWE-613 11/10/2026

macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.

CVE-2026-108784 Média · 6.5 CWE-840 11/10/2026

macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

CVE-2026-10070 Média · 4.7 CWE-266 29/05/2026

macrozheng mall Super Admin Password update improper authorization

A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

CVE-2026-25858 Crítica · 9.1 CWE-640 07/02/2026

macrozheng mall: exposição de OTP na redefinição de senha permite tomada de conta

O macrozheng mall na versão 1.0.3 e anteriores contém uma vulnerabilidade de autenticação no fluxo de redefinição de senha do mall-portal que permite a um atacante não autenticado redefinir senhas de contas de usuários arbitrários usando apenas o número de telefone de uma vítima. O fluxo de redefinição expõe a senha de uso único (OTP) diretamente na resposta da API e valida as solicitações de redefinição apenas comparando o OTP fornecido com um valor armazenado por número de telefone, sem verificar a identidade do usuário nem a posse do número de telefone. Isso possibilita a tomada de conta remota de qualquer usuário com um número de telefone conhecido ou facilmente adivinhável.

CVE-2025-15118 Média · 4.3 CWE-266 28/12/2025

macrozheng mall Member Endpoint update improper authorization

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVE-2025-14016 Alta · 8.1 CWE-863 04/12/2025

macrozheng mall-swarm delete improper authorization

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-13443 Média · 6.5 CWE-266 20/11/2025

macrozheng mall delete access control

A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVE-2025-13118 Média · 4.3 CWE-266 13/11/2025

macrozheng mall-swarm paySuccess improper authorization

A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-13117 Média · 5.3 CWE-266 13/11/2025

macrozheng mall-swarm/mall cancelOrder improper authorization

A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-13116 Média · 5.3 CWE-266 13/11/2025

macrozheng mall-swarm/mall cancelUserOrder improper authorization

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-13115 Média · 5.3 CWE-266 13/11/2025

macrozheng mall-swarm/mall Order Details detail improper authorization

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-13114 Média · 5.3 CWE-266 13/11/2025

macrozheng mall-swarm attr updateAttr improper authorization

A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.