Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
8.2CVSS5.8AI score0.00209EPSS
SaveExploits1References1
Cvelist•added 2026/01/12 12:00 a.m.•32 views
CVE-2023-36331
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
