CVE-2026-82423

medium

Description

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

References

https://vuldb.com/vuln/397008/cti

https://vuldb.com/vuln/397008

https://vuldb.com/submit/887391

https://vuldb.com/cve/CVE-2026-82423

https://github.com/macrozheng/mall/issues/985

https://github.com/macrozheng/mall/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-68138

Details

Source: Mitre, NVD

Published: 2026-08-29

Updated: 2026-09-01

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00437