gz-yami vulnerabilities

Newest CVEs

• CVE-2026-111615

  Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

  gz-yami · mall4cloud

  High7.1
• CVE-2026-108691

  mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList

  gz-yami · mall4j

  Medium5.3
• CVE-2026-108690

  mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

  gz-yami · mall4j

  Medium5.3
• CVE-2026-102367

  mall4j through 4.0 Insufficient Session Expiration via Token Refresh

  gz-yami · mall4j

  Medium5.3
• CVE-2026-102366

  mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints

  gz-yami · mall4j

  Low2.1
• CVE-2026-102365

  mall4j through 4.0 Missing Authorization in Admin User Address Endpoints

  gz-yami · mall4j

  High7.1
• CVE-2026-102364

  mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

  gz-yami · mall4j

  Medium5.3
• CVE-2026-102363

  mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

  gz-yami · mall4j

  Medium6.3
• CVE-2026-102362

  mall4j through 4.0 Missing Authentication in Product Review Deletion

  gz-yami · mall4j

  Medium6.9
• CVE-2026-102361

  mall4j through 4.0 Missing Authentication in Password Update Endpoint

  gz-yami · mall4j

  Critical9.3