CVE-2026-15186
MediumCVSS 6.3Summary
A vulnerability was found in macrozheng mall up to version 1.0.3 in the file /returnApply/create of the Portal Endpoint component. Manipulation of the orderId argument leads to improper control of resource identifiers. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized access to system resources, potentially leading to data leakage or order manipulation. The publicly available exploit increases the likelihood of rapid exploitation.
Recommendation
Immediately update macrozheng mall to the latest version if available, or apply temporary mitigations such as input validation for the orderId argument at the application level.
Other vulnerabilities in macrozheng mall
See all- CVE-2026-82423Medium
In macrozheng mall up to 1.0.3, a vulnerability exists in the Payment Status Endpoint component, in the file /order/paySuccess, where manipulation of the orderId argument leads to enforcement of behavioral workflow. The attack can be carried out remotely. The vendor deleted the GitHub issue without explanation.
- CVE-2026-82364Medium
A vulnerability has been detected in macrozheng mall up to 1.0.3. It affects an unknown function in the file /order/submit of the Order Submission component. The manipulation leads to a race condition. The attack can be initiated remotely but is considered difficult to exploit. The vendor deleted the GitHub issue without explanation.
- CVE-2026-25858Critical
In macrozheng mall version 1.0.3 and prior, there is an authentication vulnerability in the mall-portal password reset workflow. An unauthenticated attacker can reset any user's password using only the victim's telephone number. The one-time password (OTP) is exposed in the API response, and the reset request is validated solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number.
- CVE-2026-79406Medium
A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
- CVE-2026-10070Medium
Macrozheng mall up to version 1.0.3 has an authorization bypass vulnerability in the Super Admin Password Handler component in the /admin/update/ file. The attack can be performed remotely.
Original NVD description (English source)
A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.