CVE-2026-109410 is a medium severity vulnerability in macrozheng mall version 1.0.3 dcaa93b. It involves an incorrect calculation in the OmsOrderServiceImpl.updateMoneyInfo function within the mall-admin/mall-portal component. The vulnerability can be exploited remotely but requires high privileges and user interaction. The vendor has not provided a patch or explanation, and the GitHub issue related to this vulnerability was deleted without comment.
CVE-2026-109407 is a low-severity race condition vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves the Coupon Redemption component's /order/generateOrder file, where manipulation of the couponId argument can trigger the race condition. Exploitation requires high complexity and is assessed as difficult. No official patch or remediation guidance is available, and the vendor has not provided explanation after deleting the related GitHub issue.
CVE-2026-109406 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves business logic errors in the OmsPortalOrderServiceImpl function within the /order/generateOrder component. The vulnerability arises from manipulation of the coupon_amount and pay_amount arguments, which can be exploited remotely. No official patch or remediation guidance is currently available, and the vendor has not provided further information, having deleted the related GitHub issue without explanation.
CVE-2026-108785 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves a flaw in the JwtTokenUtil.refreshHeadToken function within the JwtAuthenticationTokenFilter component, which can be exploited remotely to cause session expiration. An exploit has been published, and a patch identified by commit 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a is recommended to remediate the issue.
CVE-2026-108784 is a business logic vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It affects the Payment Endpoint component, specifically the AlipayServiceImpl.pay function, where manipulation of the total_amount argument can cause business logic errors. The vulnerability can be exploited remotely without authentication. A patch identified by commit dcaa93b3150352e5044708d7211b5bed0af4509f is available to remediate this issue. The CVSS 4.0 base score is 6.9, indicating medium severity.
CVE-2026-82423 is a medium severity vulnerability in macrozheng mall up to version 1.0.3. It involves an unknown function in the /order/paySuccess endpoint of the Payment Status component. The vulnerability arises from manipulation of the orderId argument, which leads to enforcement of behavioral workflow. The attack can be performed remotely. The vendor has not provided a patch or remediation guidance and deleted the related GitHub issue without explanation.
CVE-2026-82364 is a race condition vulnerability in macrozheng mall versions 1.0.0 through 1.0.3 affecting the /order/submit component. The vulnerability can be triggered remotely but requires high attack complexity and is difficult to exploit. There is no official remediation or patch available, and the vendor has not provided further details or explanation after deleting the related GitHub issue. The CVSS 4.0 score rates this vulnerability as low severity.
CVE-2026-79406 is a medium severity vulnerability in macrozheng mall versions 1.0.0 through 1.0.3. It involves business logic errors in the OmsCartItemServiceImpl.updateQuantity function, where manipulation of the quantity argument can lead to unintended behavior. The vulnerability can be exploited remotely without user interaction. No official patch or vendor advisory is available, and the vendor removed the related GitHub issue without explanation.
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.
A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.