Skip to content
OpenAdvisories

Vendor

PickMall

3 known vulnerabilities.

Products

lilishop 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-111647

    PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}

    PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another bu…

    PickMall lilishop
  • Medium 6.5
    CVE-2026-110121

    PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

    PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /…

    PickMall lilishop
  • Medium 4.3
    CVE-2026-110122

    PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

    PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.f…

    PickMall lilishop