CVE-2025-10422
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7, the paySuccess function in /paySuccess (Order Status Handler component) is vulnerable to manipulation of the orderNo argument leading to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely change order states without proper authorization, potentially leading to financial abuse or data exposure. The public availability of the exploit increases the risk.
Recommendation
Apply the vendor fix or mitigation if available and verify authorization checks for order status changes. Monitor suspicious requests to /paySuccess.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26219Critical
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
- CVE-2026-26218Critical
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
- CVE-2026-105573Medium
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-94045Low
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
- CVE-2025-10423Low
In newbee-mall 1.0, the mallKaptcha function in /common/mall/kaptcha produces a guessable captcha. The attack can be executed remotely, is of high complexity and difficult exploitability, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderNo leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS