Threats affecting pkg:github/zongxr/SuperMarket

CVE-2026-103539 is a medium severity vulnerability in ZongXR SuperMarket version 1.0.0.0. It involves a missing authentication weakness in the startBuy function of the Instant Buy component. This flaw allows remote attackers to manipulate the Username argument to bypass authentication. The vulnerability has a CVSS 4.0 score of 5.3 and public exploit code is available. The vendor has been informed but has not yet responded or issued a patch.

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-103536 is a medium-severity vulnerability in ZongXR Supermarket version 1.0.0.0. It affects the OrderController.addOrder function, where manipulation of the userId argument leads to missing authentication. This flaw allows remote attackers to potentially bypass authentication controls. The vulnerability is publicly known and exploit code is available, but there is no vendor response or patch at this time.