Threats tagged 'ghsa-3crc-5c36-jfx7'

waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the /callback/order/unpaid endpoint. This flaw allows unauthenticated attackers to cancel any member's pending unpaid order by submitting predictable orderSn values. The vulnerability can be exploited to manipulate product stock levels by auto-cancelling unpaid orders.