Threats tagged 'ghsa-mr8h-778f-8vq8'

A vulnerability in newbee-mall-plus up to version 2.4.1 affects the executeSeckill function in the /seckillExecution/ endpoint. The flaw allows remote attackers to bypass authorization by manipulating the userid argument. Exploitation is considered difficult due to high attack complexity. Public exploit code exists, but no known active exploitation in the wild has been reported. The CVSS score is 3.7, indicating low severity.