CVE-2026-19361

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19361", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-08T19:02:55.433Z", "datePublished": "2026-08-09T17:15:09.873Z", "dateUpdated": "2026-08-13T19:05:03.124Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-09T17:15:09.873Z"}, "title": "macrozheng mall mall-portal getAuthCode password recovery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-640", "lang": "en", "description": "Weak Password Recovery"}]}], "affected": [{"vendor": "macrozheng", "product": "mall", "versions": [{"version": "0504e86", "status": "affected"}], "cpes": ["cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*"], "modules": ["mall-portal Module"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-08T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-08T21:08:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "wr0ld (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/387215", "name": "VDB-387215 | macrozheng mall mall-portal getAuthCode password recovery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/387215/cti", "name": "VDB-387215 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19361", "name": "CVE-2026-19361 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/866081", "name": "Submit #866081 | macrozheng mall Commit 0504e86 Broken Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/macrozheng/mall/issues/979", "tags": ["issue-tracking"]}, {"url": "https://github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication/issues/1", "tags": ["exploit", "issue-tracking", "patch"]}, {"url": "https://github.com/macrozheng/mall/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T19:04:55.609795Z", "id": "CVE-2026-19361", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T19:05:03.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19361", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T19:04:55.609795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T19:04:58.741Z"}}], "cna": {"title": "macrozheng mall mall-portal getAuthCode password recovery", "credits": [{"lang": "en", "type": "reporter", "value": "wr0ld (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*"], "vendor": "macrozheng", "modules": ["mall-portal Module"], "product": "mall", "versions": [{"status": "affected", "version": "0504e86"}]}], "timeline": [{"lang": "en", "time": "2026-08-08T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-08T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-08T21:08:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/387215", "name": "VDB-387215 | macrozheng mall mall-portal getAuthCode password recovery", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/387215/cti", "name": "VDB-387215 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19361", "name": "CVE-2026-19361 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/866081", "name": "Submit #866081 | macrozheng mall Commit 0504e86 Broken Authentication", "tags": ["third-party-advisory"]}, {"url": "https://github.com/macrozheng/mall/issues/979", "tags": ["issue-tracking"]}, {"url": "https://github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication/issues/1", "tags": ["exploit", "issue-tracking", "patch"]}, {"url": "https://github.com/macrozheng/mall/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "Weak Password Recovery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-09T17:15:09.873Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19361", "state": "PUBLISHED", "dateUpdated": "2026-08-13T19:05:03.124Z", "dateReserved": "2026-08-08T19:02:55.433Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-09T17:15:09.873Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*"], "modules": ["mall-portal Module"], "product": "mall", "vendor": "macrozheng", "versions": [{"status": "affected", "version": "0504e86"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una falla en macrozheng mall 0504e86. Esta vulnerabilidad afecta c\u00f3digo desconocido del archivo /sso/getAuthCode del componente M\u00f3dulo mall-portal. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a una recuperaci\u00f3n de contrase\u00f1a d\u00e9bil. El ataque puede lanzarse remotamente. Este ataque se caracteriza por una alta complejidad. Se afirma que la explotabilidad es dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. El proveedor elimin\u00f3 el problema de GitHub para esta vulnerabilidad sin ninguna explicaci\u00f3n. Posteriormente, se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n por correo electr\u00f3nico, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-19361", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19361", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T19:04:55.609795Z", "version": "2.0.3"}}]}, "published": "2026-08-09T18:16:42.930", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/macrozheng/mall/"}, {"source": "cna@vuldb.com", "url": "https://github.com/macrozheng/mall/issues/979"}, {"source": "cna@vuldb.com", "url": "https://github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication/issues/1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19361"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/866081"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387215"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387215/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0504e86"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "mall", "source": "cna", "vendor": "macrozheng"}, "product": "mall", "vendor": "macrozheng"}], "created": "2026-08-09T18:30:04.161371+00:00", "updated": "2026-08-10T00:00:07.444746+00:00", "vendors": ["macrozheng", "macrozheng$PRODUCT$mall"]}