Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-110127

waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-111659

Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-110125

waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-110126

waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-111660

waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall
CVE-2026-111661

waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wayn111
Products
Waynboot-mall