Threats affecting pkg:maven/com.youlai/mall

CVE-2026-108784 is a business logic vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It affects the Payment Endpoint component, specifically the AlipayServiceImpl.pay function, where manipulation of the total_amount argument can cause business logic errors. The vulnerability can be exploited remotely without authentication. A patch identified by commit dcaa93b3150352e5044708d7211b5bed0af4509f is available to remediate this issue. The CVSS 4.0 base score is 6.9, indicating medium severity.

A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java. Such manipulation of the argument orderSn leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.