CVE-2025-10423 newbee-mall kaptcha mallKaptcha Captcha

A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered...

CVE-2025-10423 newbee-mall kaptcha mallKaptcha Captcha

A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered...

CVE-2025-10423

Affected: newbee-mall 1.0. Vulnerable component: mallKaptcha in /common/mall/kaptcha where the CAPTCHA generation is prone to being guessable. Impact: remote attacker can exploit to bypass CAPTCHA; attack complexity is high and authentication is not required. Exploitability: publicly disclosed Po...

CVE-2025-10422 newbee-mall Order Status paySuccess improper authorization

A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderNo leads to improper authorization. Remote exploitation of...

CVE-2025-10422 newbee-mall Order Status paySuccess improper authorization

A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderNo leads to improper authorization. Remote exploitation of...

CVE-2025-10422

CVE-2025-10422 affects the newbee-mall Order Status Handler, specifically the paySuccess function in the /paySuccess file. The vulnerability arises from manipulating the orderNo parameter, causing improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed....

PT-2025-37443

Name of the Vulnerable Software and Affected Versions: newbee-mall versions prior to 613a662adf1da7623ec34459bc83e3c1b12d8ce7 Description: A vulnerability exists in newbee-mall related to improper authorization. The issue affects the paySuccess function within the /paySuccess file of the Order...

newbee-mall 安全漏洞

newbee-mall is a newbee open source e-commerce system. A security vulnerability exists in version 1.0 of newbee-mall, which originates from a function mallKaptcha in file /common/mall/kaptcha that generates guessable CAPTCHA, which could lead to a remote attack...

PT-2025-37446

Name of the Vulnerable Software and Affected Versions: newbee-mall version 1.0 Description: A flaw exists within the mallKaptcha function located in the /common/mall/kaptcha file, leading to the generation of guessable CAPTCHAs. This issue can be exploited remotely and is considered difficult to...

Weitong Mall 授权问题漏洞

Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun, an individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0.0, which stems from an improper authorization issue in the /adposition/queryAll file...

CVE-2025-9836

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be...

Weitong Mall 授权问题漏洞

Weitong Mall 微同商城 is a shopping mall system by fuyanglipengjun individual developer. An authorization issue vulnerability exists in Weitong Mall version 1.0.0, which originates from improper authorization of function AdController in file /ad/queryAll...

CVE-2025-9836

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be...

CVE-2025-9836 macrozheng mall paySuccess authorization

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be...

CVE-2025-9836 macrozheng mall paySuccess authorization

A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be...

CVE-2025-9835 macrozheng mall cancelUserOrder cancelOrder authorization

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

CVE-2025-9835

CVE-2025-9835 affects macrozheng mall up to version 1.0.3. The vulnerability resides in the cancelOrder function in /order/cancelUserOrder; manipulating the orderId parameter bypasses authorization, enabling a remote attack. Public disclosures/PoC appear in the connected sources, with CVSS estima...

CVE-2025-9835 macrozheng mall cancelUserOrder cancelOrder authorization

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

CVE-2025-9835 macrozheng mall cancelUserOrder cancelOrder authorization

A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and m...

PT-2025-35616

Name of the Vulnerable Software and Affected Versions: macrozheng mall versions up to 1.0.3 Description: A vulnerability exists in macrozheng mall versions up to 1.0.3. The cancelOrder function within the /order/cancelUserOrder file is affected. Manipulation of the orderId argument can lead to...