Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-109410— macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation

Quick assessment

Affected

macrozheng mall

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 macrozheng 商城 1.0.3 版本（commit dcaa93b）中发现了一个漏洞。受影响的是 mall-admin/mall-portal 组件中 /order/update/moneyInfo 接口所对应的 OmsOrderServiceImpl.updateMoneyInfo 方法。该漏洞可能导致金额计算错误。攻击者可以远程发起攻击。供应商在未提供任何解释的情况下删除了 GitHub 上与该漏洞相关的问题报告。

CVSS 2.4 · Low EPSS 0.27% · P18 Updated Oct 17, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
macrozheng	mall	`1.0.3 dcaa93b`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

数值计算不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
macrozheng	mall	1.0.3 dcaa93b	`cpe:2.3:a:macrozheng:mall::::::::`

II. Public POCs for CVE-2026-109410

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109410

请登录查看更多情报信息。

Vendor Pages for CVE-2026-109410 (1)

🔗 GitHub - macrozheng/mall: mall项目是一套电商系统，包括前台商城系统及后台管理系统，基于Spring Boot+MyBatis实现，采用Docker容器化部署。前台商城系统包含首页门户、商品推荐、商品搜索、商品展示、购物车、订单流程、会员中心、客户服务、帮助中心等模块。后台管理系统包含商品管理、订单管理、会员管理、促销管理、运营管理、内容管理、统计报表、财务管理、权限管理、设置等模块。 · GitHub product

Other References for CVE-2026-109410 (1)

🔗 GitHub · Where software is built issue-tracking

https://www.cve.org/CVERecord?id=CVE-2026-109410

Same Patch Batch · macrozheng · 2026-10-13 · 3 CVEs total

CVE-2026-109406	5.4 MEDIUM	macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error
CVE-2026-109407	3.1 LOW	macrozheng mall Coupon Redemption generateOrder race condition

IV. Related Vulnerabilities

Same product: mall

Same vendor: macrozheng

Same weakness: CWE-682

V. Comments for CVE-2026-109410

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-109410— macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-109410

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-109410

III. Intelligence Information for CVE-2026-109410

Vendor Pages for CVE-2026-109410 (1)

Other References for CVE-2026-109410 (1)

Same Patch Batch · macrozheng · 2026-10-13 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-109410

Leave a comment