CVE-2024-57432

The macrozheng mall-tiny version 1.0.1 is vulnerable to an Insecure Permissions issue due to hardcoded JWT signing keys that do not change. Because user information is explicitly written into the JWT and used for privilege management, an attacker can forge the JWT of any user to achieve an authen...

CVE-2024-57433

The macrozheng mall-tiny scaffolding software version 1.0.1 is vulnerable to Incorrect Access Control (CWE-284) due to a flaw in the logout function . When a user logs out, their session token remains valid and can still be used to fetch information in a logged-in state. As a temporary workaround...

CVE-2024-57434

The Macrozheng Mall-Tiny development scaffolding (version 1.0.1 ) is vulnerable to Incorrect Access Control . The underlying cause is that the project imports users by default, which automatically grants the test user super administrator privileges. Practical consequences include unauthorized adm...

CVE-2024-57435

The macrozheng mall-tiny version 1.0.1 software is vulnerable to a NULL Pointer Dereference (CWE-476). An attacker can trigger this by sending null data through the resource creation interface . This flaw causes a denial-of-service (DoS) attack and leads to service restart failure during any subs...