CVE-2023-36331

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-363376.1A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers CVE-2023-363385.3Inventory Management System 1 was discovered to contain a SQL injection vulnerability.CVE-2023-363397.5An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.CVE-2023-36348.8In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mod CVE-2023-363409.8TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.CVE-2023-363447.8An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting th CVE-2023-363458.8A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.CVE-2023-363466.1POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.CVE-2023-363477.5A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.CVE-2023-363488.8POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.CVE-2023-36357.5GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the CVE-2023-363517.8An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.ba