CVE-2026-82423

2.1 lowEPSS 0.4%

Low (2.1). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWEs: CWE-840, CWE-841
Published: 2026-08-29
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

References

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/issues/985
https://vuldb.com/cve/CVE-2026-82423
https://vuldb.com/submit/887391
https://vuldb.com/vuln/397008

Check your stack JSON