Threat database

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the /callback/order/unpaid endpoint. This flaw allows unauthenticated attackers to cancel any member's pending unpaid order by submitting predictable orderSn values. The vulnerability can be exploited to manipulate product stock levels by auto-cancelling unpaid orders.

Waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the internal /callback/order/submit endpoint. This flaw allows unauthenticated attackers to forge orders by supplying arbitrary user, address, and cart identifiers. Exploitation can lead to unauthorized order creation, exposure of stored shipping details, cart clearing, and stock decrementing.

CVE-2026-110127 is an authorization bypass vulnerability in waynboot-mall up to version 2.0.0. It affects the mobile CartController, allowing authenticated users to modify or delete other users' cart items by exploiting insecure direct object references. Attackers can enumerate sequential cart IDs using specific API endpoints to change quantities, selection states, or remove items from other members' carts.

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.

Waynboot-mall versions up to 2.0.0 contain an insecure direct object reference vulnerability that allows authenticated users to access and modify other users' orders by manipulating order identifiers. Attackers can enumerate sequential order IDs via various endpoints to view sensitive recipient information or disrupt orders. The vulnerability has a medium severity with a CVSS score of 5.3.