CVE-2026-82423

MediumCVSS 5.4/10Last modified Sep 1, 2026

Description

A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payment Status Endpoint. The manipulation of the argument orderId leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-840 CWE-841

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-824246.3A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-82425A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in d CVE-2026-824266.5Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and ope CVE-2026-824277.8Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That CVE-2026-824288.8Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate,CVE-2026-824297.8Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS a CVE-2026-82435.3A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This affects an unknown function of the component JNL CVE-2026-824307.8Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory CVE-2026-824319.8Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.gro CVE-2026-824328.1Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts CVE-2026-824336.5Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where CVE-2026-824346.5Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology