{"id":"CVE-2026-82423","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82423","generatedAt":"2026-10-28T00:19:46.285Z","title":"A vulnerability has been found in macrozheng mall up to 1.0.3.","description":"A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.","published":"2026-08-29T23:17:24.000Z","lastModified":"2026-09-01T03:16:52.000Z","status":"Deferred","sourceIdentifier":"cna@vuldb.com","cvss":{"version":"4.0","score":2.1,"severity":"LOW","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-840","CWE-841"],"affected":[],"epss":{"score":0.00437,"percentile":0.37749,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/macrozheng/mall/","source":"cna@vuldb.com"},{"url":"https://github.com/macrozheng/mall/issues/985","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-82423","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/887391","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/397008","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/397008/cti","source":"cna@vuldb.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82423","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}