Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
8.2CVSS5.8AI score0.00206EPSS
SaveExploits1References1
Cvelist•added 2026/01/12 12:0 a.m.•26 views
CVE-2023-36331
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...
