CVE-2023-36331

The xmall distributed e-commerce shopping mall (version 1.1 ) contains an incorrect access control vulnerability in the /member/orderList API. An attacker can arbitrarily access other users' order details by manipulating the userId query parameter. Exploitation details are not provided, but the v...

PT-2025-19780 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is related to incorrect access control, allowing attackers to bypass authentication. This can be achieved via a crafted GET request to the "/index" API endpoint. Recommendations: For xmall version 1.1,...

CVE-2025-45612

Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index...

CVE-2025-45612

The xmall e-commerce platform (v1.1) contains an incorrect access control vulnerability. An attacker can bypass authentication by sending a crafted GET request to the "/index" API endpoint. This flaw allows unauthorized access to the system. As a temporary workaround, users are advised to restric...

CVE-2024-24112

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...

PT-2024-20276 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is a SQL injection vulnerability. It occurs via the orderDir parameter. Recommendations: For xmall version 1.1, as a temporary workaround, consider restricting the use of the orderDir parameter until a...