What is the CVSS score of CVE-2023-36331?

CVE-2023-36331 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Xmall are affected by CVE-2023-36331?

Organizations using the /member/orderList API of xmall face notable risk from CVE-2023-36331, a IDOR vulnerability rated CVSS 8.2.

Is there a public PoC exploit available for CVE-2023-36331?

Yes, a public proof-of-concept exploit is available for CVE-2023-36331. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2023-36331?

Within 7 days: Identify all affected systems running the /member/orderList API of xmall and apply vendor patches promptly. Monitor vendor channels for patch availability.

Xmall CVE-2023-36331

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-01-12 cve@mitre.org

Authentication Bypass Xmall Exrick

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 22, 2026 - 21:09 vuln.today

Public exploit code

CVE Published

Jan 12, 2026 - 20:15 nvd

HIGH 8.2

DescriptionCVE.org

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

AnalysisAI

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId. [CVSS 8.2 HIGH]

Technical ContextAI

Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects the manipulation of the query component of Xmall. Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.