[ Vendor · 10 CVEs ]
gz-yami
CVEs affecting gz-yami published in the last 30 days, plus any gz-yami CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111615 | 16 Oct 2026 | CVSS 6.5 | gz-yami mall4cloudMall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer… | |
| CVE-2026-108690 | 11 Oct 2026 | CVSS 4.3 | gz-yami mall4jmall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an… | |
| CVE-2026-108691 | 11 Oct 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart… | |
| CVE-2026-102367 | 29 Sep 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag… | |
| CVE-2026-102361 | 29 Sep 2026 | CVSS 9.1 | gz-yami mall4jmall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset… | |
| CVE-2026-102362 | 29 Sep 2026 | CVSS 5.3 | gz-yami mall4jmall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can… | |
| CVE-2026-102363 | 29 Sep 2026 | CVSS 3.7 | gz-yami mall4jmall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated… | |
| CVE-2026-102364 | 29 Sep 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by… | |
| CVE-2026-102365 | 29 Sep 2026 | CVSS 6.5 | gz-yami mall4jmall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated… | |
| CVE-2026-102366 | 29 Sep 2026 | CVSS 4.4 | gz-yami mall4jmall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary… |