What’s Vulnerable › Products

gz-yami mall4j vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your gz-yami mall4j version is affected

Latest gz-yami mall4j vulnerabilities

• CVE-2026-108691 — mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList (CVSS 5.4)
• CVE-2026-108690 — mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList (CVSS 4.3)
• CVE-2026-102367 — mall4j through 4.0 Insufficient Session Expiration via Token Refresh (CVSS 5.4)
• CVE-2026-102366 — mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints (CVSS 4.4)
• CVE-2026-102365 — mall4j through 4.0 Missing Authorization in Admin User Address Endpoints (CVSS 6.5)
• CVE-2026-102364 — mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API (CVSS 5.4)
• CVE-2026-102363 — mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number (CVSS 3.7)
• CVE-2026-102362 — mall4j through 4.0 Missing Authentication in Product Review Deletion (CVSS 5.3)
• CVE-2026-102361 — mall4j through 4.0 Missing Authentication in Password Update Endpoint (CVSS 9.1)