Threats tagged 'ghsa-fppm-ghp9-2597'

A security vulnerability (CVE-2025-13117) exists in macrozheng mall-swarm versions up to 1.0.3. The flaw is in the cancelOrder function within the /order/cancelOrder file, where improper authorization occurs due to manipulation of the orderId argument. This vulnerability can be exploited remotely. Public exploit details have been disclosed, but the vendor has not responded or provided a fix. The vulnerability has a medium severity rating with a CVSS score of 5.4.