Skip to content
OpenAdvisories

Product · gz-yami

mall4cloud

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-111615

    Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

    Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment …

    gz-yami mall4cloud