CVE-2026-111661 waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,...

CVE-2026-111661 waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,...

EUVD-2026-103083

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,...

CVE-2026-111661

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail,...

CVE-2026-111661

The waynboot-mall software (through version 2.0.0 ) is vulnerable to missing authentication via the anonymously mapped /callback/email endpoint. An unauthenticated attacker can call EmailController.sendEmail to send arbitrary emails by providing the subject, content, and recipient. This allows fo...

CVE-2026-111659 Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders...

CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111659

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders...

EUVD-2026-103081

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders...

CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111660

The waynboot-mall software (through version 2.0.0 ) is vulnerable to a missing authentication flaw (CWE-306) within the /callback/order/unpaid endpoint. This vulnerability allows unauthenticated attackers to cancel any member's pending orders by submitting predictable orderSn values, which are co...

EUVD-2026-103082

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to...

CVE-2026-111659

Versions of Waynboot-mall through 2.0.0 are vulnerable to an unauthenticated order forgery due to a missing authentication vulnerability in the internal /callback/order/submit message-queue callback. Attackers can submit arbitrary userId , addressId , and cart ids within the order JSON to perform...

CVE-2026-111659 Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders...

CVE-2026-111653 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

EUVD-2026-103075

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when ISSAAS is true, attackers can enumerate sequential...

CVE-2026-111653

The 53AIHub application (versions through 0.5.3 ) is vulnerable to a missing authentication flaw in the /api/enterprises/:id endpoint. The root cause is that the UpdateEnterprise function only enforces authentication checks when the IS_SAAS flag is true. Consequently, unauthenticated attackers ca...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...

CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider,...