Skip to main content

macrozheng mall EUVDEUVD-2026-68138

| CVE-2026-82423 LOW
Improper Enforcement of Behavioral Workflow (CWE-841)
2026-08-29 VulDB GHSA-699j-wcw4-p222
Information Disclosure Mall Macrozheng
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network endpoint requires authenticated session (PR:L); impact is limited to order status integrity manipulation with no confidentiality or availability consequence demonstrated.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVE Published
Aug 31, 2026 - 10:50 cve.org
LOW 2.1
Severity Changed
Aug 29, 2026 - 23:22 NVD
MEDIUM LOW
CVSS changed
Aug 29, 2026 - 23:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
Aug 29, 2026 - 22:51 vuln.today

DescriptionCVE.org

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

AnalysisAI

Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the mall application (PR:L in CVSS 4.0) - unauthenticated exploitation is not supported by the available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/E:P) characterizes this as a remotely exploitable, low-complexity flaw requiring low privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mall

View all
CVE-2026-25858 CRITICAL
9.3 Feb 07

macrozheng mall e-commerce platform v1.0.3 has an authentication vulnerability in password reset enabling unauthorized a
CVE-2026-19361 LOW POC
2.9 Aug 09

Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal modu
CVE-2025-4119 MEDIUM
6.9 Apr 30

A vulnerability classified as critical was found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerabi
CVE-2025-4118 MEDIUM
6.9 Apr 30

A vulnerability classified as critical has been found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vuln
CVE-2025-8741 LOW POC
2.9 Aug 08

A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remote
CVE-2025-13115 LOW POC
2.1 Nov 13

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), thi
CVE-2025-13118 LOW POC
2.1 Nov 13

A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulne
CVE-2025-13117 LOW POC
2.1 Nov 13

A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.
CVE-2025-13116 LOW POC
2.1 Nov 13

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vul
CVE-2025-15118 LOW POC
2.1 Dec 28

Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member add
CVE-2025-13443 LOW POC
2.1 Nov 20

A vulnerability was detected in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is rem
CVE-2025-9835 LOW POC
2.1 Sep 02

A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is r

Same weakness CWE-841 – Improper Enforcement of Behavioral Workflow

View all
CVE-2023-4181 CRITICAL POC
9.8
CVE-2026-55763 HIGH POC
8.7
CVE-2024-46307 HIGH POC
7.5
CVE-2026-30574 HIGH POC
7.5
CVE-2025-52469 HIGH POC
7.1
CVE-2026-67279 MEDIUM POC
6.9
CVE-2024-6128 MEDIUM POC
6.9
CVE-2026-3130 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-68138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy