CVE-2026-109406

MediumCVSS 5.4/10Last modified Oct 14, 2026

Description

A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-840

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1094073.1A security vulnerability has been detected in macrozheng mall up to 1.0.3. This issue affects some unknown processing of the file /order/gen CVE-2026-1094095.3A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/s CVE-2026-109418.8Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a san CVE-2026-1094102.4A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of CVE-2026-1094129.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication inf CVE-2026-1094138.7In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() a CVE-2026-1094146.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / sr CVE-2026-1094155.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-109427.8Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalati CVE-2026-1094228.1NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in CVE-2026-1094237.4NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerabilit CVE-2026-1094245.9NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /ea