Threats tagged 'ghsa-gvqp-2ghw-m8w7'

Waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the internal /callback/order/submit endpoint. This flaw allows unauthenticated attackers to forge orders by supplying arbitrary user, address, and cart identifiers. Exploitation can lead to unauthorized order creation, exposure of stored shipping details, cart clearing, and stock decrementing.