Description
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
High · 8.2
CVE-2023-36331
EUVD-2023-40299GHSA-7v52-p3w5-3m2m
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via m…
Published Jan 12, 2026 · Updated Jan 12, 2026 · Assigned by mitre