Macrozheng

By the Year

In 2026 there have been 7 vulnerabilities in Macrozheng with an average score of 5.6 out of ten. Last year, in 2025 Macrozheng had 12 security vulnerabilities published. Right now, Macrozheng is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.26.

Recent Macrozheng Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-82423	Aug 29, 2026	macrozheng mall <=1.0.3: Payment Status Endpoint Remote orderId RCE A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.	Mall
CVE-2026-82364	Aug 29, 2026	Macrozheng Mall 1.0.3 Order Sub Race Cond (CVE-2026-82364) A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Submission. The manipulation leads to race condition. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation.	Mall
CVE-2026-79406	Aug 25, 2026	MacroZh Mall 1.0.3 OmsCartItemServiceImpl updQty Remote BizLogic V A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.	Mall
CVE-2026-19361	Aug 09, 2026	Macrozheng Mall: Remote Weak Password Recovery via /sso/getAuthCode (RCE) A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.	Mall
CVE-2026-15186	Jul 09, 2026	macrozheng mall <=1.0.3 Remote ID Control via /returnApply/create A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.	Mall
CVE-2026-10070	May 29, 2026	Improper Authorization via Super Admin Password Handler in Macrozheng Mall <=1.0.3 (CVE-2026-10070) A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.	Mall
CVE-2026-25858	Feb 07, 2026	macrozheng mall-portal v1.0.3: unauth reset via OTP leak in password reset macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victims telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.
CVE-2025-15118	Dec 28, 2025	Improper auth in MacroZheng Mall Member Endpoint before v1.0.3 A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2025-14016	Dec 04, 2025	mallswarm 1.0.3 delete /member/readHistory/delete Improper Authorization A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Mall Swarm
CVE-2025-13443	Nov 20, 2025	Macrozheng Mall 1.0.3 Improper Access Control in /member/readHistory/delete A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.