CVE-2023-36331

The xmall e-commerce platform (version 1.1 ) is vulnerable to an incorrect access control flaw in the /member/orderList API. An attacker can arbitrarily access other users' order details by manipulating the userId query parameter. The root cause is the lack of proper validation to ensure that the...

PT-2025-19780 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is related to incorrect access control, allowing attackers to bypass authentication. This can be achieved via a crafted GET request to the "/index" API endpoint. Recommendations: For xmall version 1.1,...

CVE-2025-45612

The software xmall v1.1 , a distributed e-commerce shopping mall, contains an incorrect access control vulnerability. This flaw allows an attacker to bypass authentication by sending a crafted GET request to the /index API endpoint. As a temporary workaround, it is recommended to restrict access ...

CVE-2025-45612

Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index...

CVE-2024-24112

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...

PT-2024-20276 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is a SQL injection vulnerability. It occurs via the orderDir parameter. Recommendations: For xmall version 1.1, as a temporary workaround, consider restricting the use of the orderDir parameter until a...