Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-102367 (GCVE-0-2026-102367)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Insufficient Session Expiration via Token Refresh

Summary

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-613 - Insufficient Session Expiration

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:31.264Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/T02_refresh_token_enabled_bypass.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java#L121-L130"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/controller/TokenController.java#L38-L44"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Insufficient Session Expiration via Token Refresh",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-insufficient-session-expiration-via-token-refresh"
        }
      ],
      "title": "mall4j through 4.0 Insufficient Session Expiration via Token Refresh",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102367",
    "datePublished": "2026-09-28T23:34:31.264Z",
    "dateReserved": "2026-09-28T22:50:20.304Z",
    "dateUpdated": "2026-09-28T23:34:31.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102366 (GCVE-0-2026-102366)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

Summary

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:30.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A03_admin_file_upload_xss.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/FileController.java#L44-L64"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/java/com/yami/shop/service/impl/AttachFileServiceImpl.java#L62-L81"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-unrestricted-file-upload-in-admin-file-endpoints"
        }
      ],
      "title": "mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102366",
    "datePublished": "2026-09-28T23:34:30.573Z",
    "dateReserved": "2026-09-28T22:50:19.946Z",
    "dateUpdated": "2026-09-28T23:34:30.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102365 (GCVE-0-2026-102365)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

Summary

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:29.905Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A02_admin_useraddr_bfla.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/UserAddrController.java#L46-L61"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authorization-in-admin-user-address-endpoints"
        }
      ],
      "title": "mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102365",
    "datePublished": "2026-09-28T23:34:29.905Z",
    "dateReserved": "2026-09-28T22:50:19.577Z",
    "dateUpdated": "2026-09-28T23:34:29.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102364 (GCVE-0-2026-102364)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

Summary

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:29.221Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A05_sys_menu_missing_perm.py"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A09_admin_read_endpoints_bfla.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java#L60-L119"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-improper-authentication-accepts-storefront-tokens-on-admin-api"
        }
      ],
      "title": "mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102364",
    "datePublished": "2026-09-28T23:34:29.221Z",
    "dateReserved": "2026-09-28T22:50:19.220Z",
    "dateUpdated": "2026-09-28T23:34:29.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102363 (GCVE-0-2026-102363)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

Summary

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:28.513Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number"
        }
      ],
      "title": "mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102363",
    "datePublished": "2026-09-28T23:34:28.513Z",
    "dateReserved": "2026-09-28T22:50:18.857Z",
    "dateUpdated": "2026-09-28T23:34:28.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102362 (GCVE-0-2026-102362)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authentication in Product Review Deletion

Summary

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:27.813Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A04_prodcomm_delete_anonymous.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ProdCommController.java#L84-L89"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authentication in Product Review Deletion",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-product-review-deletion"
        }
      ],
      "title": "mall4j through 4.0 Missing Authentication in Product Review Deletion",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102362",
    "datePublished": "2026-09-28T23:34:27.813Z",
    "dateReserved": "2026-09-28T22:50:18.497Z",
    "dateUpdated": "2026-09-28T23:34:27.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102361 (GCVE-0-2026-102361)

Vulnerability from nvd – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authentication in Password Update Endpoint

Summary

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:27.140Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A01_updatepwd_account_takeover.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/UserRegisterController.java#L78-L100"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authentication in Password Update Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-password-update-endpoint"
        }
      ],
      "title": "mall4j through 4.0 Missing Authentication in Password Update Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102361",
    "datePublished": "2026-09-28T23:34:27.140Z",
    "dateReserved": "2026-09-28T22:50:08.550Z",
    "dateUpdated": "2026-09-28T23:34:27.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102367 (GCVE-0-2026-102367)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Insufficient Session Expiration via Token Refresh

Summary

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-613 - Insufficient Session Expiration

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:31.264Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/T02_refresh_token_enabled_bypass.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java#L121-L130"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/controller/TokenController.java#L38-L44"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Insufficient Session Expiration via Token Refresh",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-insufficient-session-expiration-via-token-refresh"
        }
      ],
      "title": "mall4j through 4.0 Insufficient Session Expiration via Token Refresh",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102367",
    "datePublished": "2026-09-28T23:34:31.264Z",
    "dateReserved": "2026-09-28T22:50:20.304Z",
    "dateUpdated": "2026-09-28T23:34:31.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102366 (GCVE-0-2026-102366)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

Summary

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:30.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A03_admin_file_upload_xss.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/FileController.java#L44-L64"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/java/com/yami/shop/service/impl/AttachFileServiceImpl.java#L62-L81"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-unrestricted-file-upload-in-admin-file-endpoints"
        }
      ],
      "title": "mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102366",
    "datePublished": "2026-09-28T23:34:30.573Z",
    "dateReserved": "2026-09-28T22:50:19.946Z",
    "dateUpdated": "2026-09-28T23:34:30.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102365 (GCVE-0-2026-102365)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

Summary

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:29.905Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A02_admin_useraddr_bfla.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/UserAddrController.java#L46-L61"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authorization-in-admin-user-address-endpoints"
        }
      ],
      "title": "mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102365",
    "datePublished": "2026-09-28T23:34:29.905Z",
    "dateReserved": "2026-09-28T22:50:19.577Z",
    "dateUpdated": "2026-09-28T23:34:29.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102364 (GCVE-0-2026-102364)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

Summary

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:29.221Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A05_sys_menu_missing_perm.py"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A09_admin_read_endpoints_bfla.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java#L60-L119"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-improper-authentication-accepts-storefront-tokens-on-admin-api"
        }
      ],
      "title": "mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102364",
    "datePublished": "2026-09-28T23:34:29.221Z",
    "dateReserved": "2026-09-28T22:50:19.220Z",
    "dateUpdated": "2026-09-28T23:34:29.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102363 (GCVE-0-2026-102363)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

Summary

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:28.513Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number"
        }
      ],
      "title": "mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102363",
    "datePublished": "2026-09-28T23:34:28.513Z",
    "dateReserved": "2026-09-28T22:50:18.857Z",
    "dateUpdated": "2026-09-28T23:34:28.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102362 (GCVE-0-2026-102362)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authentication in Product Review Deletion

Summary

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:27.813Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A04_prodcomm_delete_anonymous.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ProdCommController.java#L84-L89"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authentication in Product Review Deletion",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-product-review-deletion"
        }
      ],
      "title": "mall4j through 4.0 Missing Authentication in Product Review Deletion",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102362",
    "datePublished": "2026-09-28T23:34:27.813Z",
    "dateReserved": "2026-09-28T22:50:18.497Z",
    "dateUpdated": "2026-09-28T23:34:27.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102361 (GCVE-0-2026-102361)

Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34

Title

mall4j through 4.0 Missing Authentication in Password Update Endpoint

Summary

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck mitre root

References

4 references

URL	Tags
https://github.com/LinYuanyi1/cve-request-poc/blo…	exploit
https://github.com/gz-yami/mall4j	product
https://github.com/gz-yami/mall4j/blob/ffc672fc1a…	technical-description
https://www.vulncheck.com/advisories/mall4j-throu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
gz-yami	mall4j	Affected: 0 , ≤ 4.0 (custom)

Date Public

2026-09-19 00:00

Credits

Mingsheng Lin

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/gz-yami/mall4j",
          "defaultStatus": "unaffected",
          "product": "mall4j",
          "repo": "https://github.com/gz-yami/mall4j",
          "vendor": "gz-yami",
          "versions": [
            {
              "lessThanOrEqual": "4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mingsheng Lin"
        }
      ],
      "datePublic": "2026-09-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T23:34:27.140Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A01_updatepwd_account_takeover.py"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/gz-yami/mall4j"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/UserRegisterController.java#L78-L100"
        },
        {
          "name": "VulnCheck Advisory: mall4j through 4.0 Missing Authentication in Password Update Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-password-update-endpoint"
        }
      ],
      "title": "mall4j through 4.0 Missing Authentication in Password Update Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-102361",
    "datePublished": "2026-09-28T23:34:27.140Z",
    "dateReserved": "2026-09-28T22:50:08.550Z",
    "dateUpdated": "2026-09-28T23:34:27.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

14 vulnerabilities by gz-yami

CVE-2026-102367 (GCVE-0-2026-102367)

CVE-2026-102366 (GCVE-0-2026-102366)

CVE-2026-102365 (GCVE-0-2026-102365)

CVE-2026-102364 (GCVE-0-2026-102364)

CVE-2026-102363 (GCVE-0-2026-102363)

CVE-2026-102362 (GCVE-0-2026-102362)

CVE-2026-102361 (GCVE-0-2026-102361)

CVE-2026-102367 (GCVE-0-2026-102367)

CVE-2026-102366 (GCVE-0-2026-102366)

CVE-2026-102365 (GCVE-0-2026-102365)

CVE-2026-102364 (GCVE-0-2026-102364)

CVE-2026-102363 (GCVE-0-2026-102363)

CVE-2026-102362 (GCVE-0-2026-102362)

CVE-2026-102361 (GCVE-0-2026-102361)