CVE-2026-79406— macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error
Quick assessment
Affected
macrozheng mall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 macrozheng mall 1.0.3 及以下版本中发现了一个安全漏洞。受影响的是文件 /cart/update/quantity 中的函数 OmsCartItemServiceImpl.updateQuantity。对参数 quantity 的操作会导致业务逻辑错误。该攻击可能由远程发起。该漏洞的 GitHub 问题已被厂商删除，但未提供任何解释。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| macrozheng | mall | 1.0.0 |
affected |
1.0.1 |
affected | ||
1.0.2 |
affected | ||
1.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79406
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
业务逻辑错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| macrozheng | mall | 1.0.0 |
cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-79406
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79406
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79406 (1)
-
🔗 CVE-2026-79406 macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error vdb-entry technical-description
Vendor Pages for CVE-2026-79406 (1)
Other References for CVE-2026-79406 (3)
-
🔗 GitHub · Where software is built issue-tracking
-
🔗 CVE-2026-79406 in mall third-party-advisory
-
IV. Related Vulnerabilities
Same product: mall
-
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery -
CVE-2026-15186
macrozheng mall Portal Endpoint create resource injection -
CVE-2026-10070
macrozheng mall Super Admin Password update improper authori -
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via -
CVE-2025-15118
macrozheng mall Member Endpoint update improper authorizatio
Same vendor: macrozheng
-
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery -
CVE-2026-15186
macrozheng mall Portal Endpoint create resource injection -
CVE-2026-10070
macrozheng mall Super Admin Password update improper authori -
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via -
CVE-2025-15118
macrozheng mall Member Endpoint update improper authorizatio
Same weakness: CWE-840
-
CVE-2026-58558
Huawei harmonyos 处理逻辑错误漏洞 -
CVE-2026-13571
SourceCodester Simple Food Ordering System cart.php logic er -
CVE-2026-41973
Huawei EMUI和Huawei HarmonyOS 安全漏洞 -
CVE-2026-11465
songquanpeng one-api Redemption Code Top-Up Endpoint redempt -
CVE-2026-8738
Sanluan PublicCMS Trade Payment Flow TradeOrderController.ja
V. Comments for CVE-2026-79406
No comments yet