CVE-2026-108690mediumCWE-783

CVE-2026-108690: fallo de gravedad media en gz-yami mall4j

mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mall4j

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 5.3epss 0.2%
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
gz-yami · mall4j
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — gz-yami mall4j

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-102361CRITICALmall4j through 4.0 Missing Authentication in Password Update EndpointEPSS 0.4%CVE-2026-102362MEDIUMmall4j through 4.0 Missing Authentication in Product Review DeletionEPSS 0.3%CVE-2026-102363MEDIUMmall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order NumberEPSS 0.3%CVE-2026-108691MEDIUMmall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdListEPSS 0.2%CVE-2026-102365HIGHmall4j through 4.0 Missing Authorization in Admin User Address EndpointsEPSS 0.2%CVE-2026-102367MEDIUMmall4j through 4.0 Insufficient Session Expiration via Token RefreshEPSS 0.2%