CVE-2026-103539
MediumCVSS 5.4Summary
A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.
Risk Assessment
Missing authentication in the purchase function can enable unauthorized transactions and data integrity compromise.
Recommendation
Immediately restrict access to the Instant Buy function, apply vendor fixes, or consider disabling the component until patched.
Other vulnerabilities in ZongXR SuperMarket
See all- CVE-2026-103538Medium
A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.
- CVE-2026-103536High
A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected is the function OrderController.addOrder in order/src/main/java/com/supermarket/order/controller/OrderController.java of the save Endpoint component. Manipulation of the userId argument leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used; the project was informed but has not responded.
Original NVD description (English source)
A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS