CVE-2026-111660
MEDIUM
6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
Description
AI Translation Available
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0041
Percentile
0,3th
Updated
EPSS Score Trend (Last 3 Days)
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-ca…
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/j…
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/ma…
https://hackmd.io/@hieuPenguinnn/waynboot-mall-unauth-callback-order-forgery-ca…
https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-missing-authen…