Gz-yami vulnerabilities

Products

• Mall4j 9

Newest

• gz-yami mall4cloud Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint CVE-2026-111615 7.1 HighOctober 16, 2026
• gz-yami mall4j mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList CVE-2026-108691 5.3 MediumOctober 11, 2026
• gz-yami mall4j mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList CVE-2026-108690 5.3 MediumOctober 11, 2026
• gz-yami mall4j mall4j through 4.0 Insufficient Session Expiration via Token Refresh CVE-2026-102367 5.3 MediumSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints CVE-2026-102366 2.1 LowSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Missing Authorization in Admin User Address Endpoints CVE-2026-102365 7.1 HighSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API CVE-2026-102364 5.3 MediumSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number CVE-2026-102363 6.3 MediumSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Missing Authentication in Product Review Deletion CVE-2026-102362 6.9 MediumSeptember 28, 2026
• gz-yami mall4j mall4j through 4.0 Missing Authentication in Password Update Endpoint CVE-2026-102361 9.3 CriticalSeptember 28, 2026