CVE-2026-15186 | A vulnerability was identified in macrozheng mall up to 1.0.… | CVSS 6.3 MEDIUM

Description

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Metadata

CVE ID: CVE-2026-15186
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-09 05:06 UTC
Published: 2026-07-09 13:15 UTC
Last updated: 2026-07-09 13:15 UTC
Primary CWE: CWE-99
Improper Control of Resource Identifiers
Vendor / Product: macrozheng / mall
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
macrozheng	mall	—	1.0.0, 1.0.1, 1.0.2, 1.0.3

Weakness (CWE)

CWE	Source	Description
CWE-99	cna	Improper Control of Resource Identifiers

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (6)

VDB-377112 | macrozheng mall Portal Endpoint create resource injection https://vuldb.com/vuln/377112
VDB-377112 | CTI Indicators (IOB, IOC, IOA) https://vuldb.com/vuln/377112/cti
CVE-2026-15186 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-15186
Submit #851347 | macrozheng mall 1.0.3 Insecure Direct Object Reference https://vuldb.com/submit/851347
https://github.com/macrozheng/mall/issues/977
https://github.com/macrozheng/mall/