https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-25858.htmlhttps://patchthecve.com/cve/CVE-2026-25858.htmlTue, 14 Jul 2026 16:16:55 +0000CRITICAL 9.1: macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password https://patchthecve.com/cve/CVE-2025-15118.htmlhttps://patchthecve.com/cve/CVE-2025-15118.htmlWed, 07 Oct 2026 12:10:00 +0000MEDIUM 4.3: A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has behttps://patchthecve.com/cve/CVE-2025-13443.htmlhttps://patchthecve.com/cve/CVE-2025-13443.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now publichttps://patchthecve.com/cve/CVE-2025-13118.htmlhttps://patchthecve.com/cve/CVE-2025-13118.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.3: A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be ushttps://patchthecve.com/cve/CVE-2025-13117.htmlhttps://patchthecve.com/cve/CVE-2025-13117.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exphttps://patchthecve.com/cve/CVE-2025-13116.htmlhttps://patchthecve.com/cve/CVE-2025-13116.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has https://patchthecve.com/cve/CVE-2025-13115.htmlhttps://patchthecve.com/cve/CVE-2025-13115.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 4.3: A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the atthttps://patchthecve.com/cve/CVE-2025-9514.htmlhttps://patchthecve.com/cve/CVE-2025-9514.htmlWed, 17 Jun 2026 10:09:08 +0000LOW 3.7: A vulnerability has been found in macrozheng mall up to 1.0.3. This impacts an unknown function of the component Registration. Such manipulation leads to weak password requirements. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is said to be diffihttps://patchthecve.com/cve/CVE-2025-8755.htmlhttps://patchthecve.com/cve/CVE-2025-8755.htmlWed, 17 Jun 2026 10:07:33 +0000MEDIUM 5.3: A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController.java of the component com.macro.mall.portal.controller. The manipulation of the argument orderId leads to authorization bypass. The attack mahttps://patchthecve.com/cve/CVE-2025-8750.htmlhttps://patchthecve.com/cve/CVE-2025-8750.htmlWed, 17 Jun 2026 10:07:33 +0000LOW 2.4: A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file /minio/upload of the component Add Product Page. The manipulation of the argument File leads to cross site scripting. The attack can be launchttps://patchthecve.com/cve/CVE-2025-8742.htmlhttps://patchthecve.com/cve/CVE-2025-8742.htmlWed, 17 Jun 2026 10:07:32 +0000LOW 3.7: A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The complhttps://patchthecve.com/cve/CVE-2025-8741.htmlhttps://patchthecve.com/cve/CVE-2025-8741.htmlWed, 17 Jun 2026 10:07:32 +0000LOW 3.7: A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/login. The manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. The comphttps://patchthecve.com/cve/CVE-2025-8191.htmlhttps://patchthecve.com/cve/CVE-2025-8191.htmlWed, 17 Jun 2026 10:06:29 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attachttps://patchthecve.com/cve/CVE-2025-4119.htmlhttps://patchthecve.com/cve/CVE-2025-4119.htmlWed, 17 Jun 2026 09:32:32 +0000MEDIUM 5.3: A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be initiathttps://patchthecve.com/cve/CVE-2025-4118.htmlhttps://patchthecve.com/cve/CVE-2025-4118.htmlWed, 17 Jun 2026 09:32:32 +0000MEDIUM 5.3: A vulnerability classified as critical has been found in Weitong Mall 1.0.0. This affects an unknown part of the file /historyList of the component Product History Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. It is possible to initiate the athttps://patchthecve.com/cve/CVE-2024-11619.htmlhttps://patchthecve.com/cve/CVE-2024-11619.htmlWed, 17 Jun 2026 06:58:05 +0000MEDIUM 5.0: A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The ex