CVE-2026-109407 is a low-severity race condition vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves the Coupon Redemption component's /order/generateOrder file, where manipulation of the couponId argument can trigger the race condition. Exploitation requires high complexity and is assessed as difficult. No official patch or remediation guidance is available, and the vendor has not provided explanation after deleting the related GitHub issue.
CVE-2026-109406 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves business logic errors in the OmsPortalOrderServiceImpl function within the /order/generateOrder component. The vulnerability arises from manipulation of the coupon_amount and pay_amount arguments, which can be exploited remotely. No official patch or remediation guidance is currently available, and the vendor has not provided further information, having deleted the related GitHub issue without explanation.
CVE-2026-108785 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves a flaw in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, which can be exploited remotely to cause session expiration. An exploit has been published, and a patch identified by commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a is recommended to remediate the issue.
A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.
A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.