Vulnerabilidades de ZongXR
CVEs publicadas que afetam produtos de ZongXR: 3 registro(s), com severidade, exploração e correções.
CVE-2026-103539
Média · 5.4
CWE-287 01/10/2026
ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-103538
Média · 6.5
CWE-287 01/10/2026
ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-103536
Alta · 7.3
CWE-287 01/10/2026
ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.