CVE-2026-15186: macrozheng mall Portal Endpoint create resource injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-10-25
Weakness: CWE-99

Description

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Affected products

macrozheng mall: 1.0.0, 1.0.1, 1.0.2, 1.0.3

References

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/issues/977
https://vuldb.com/cve/CVE-2026-15186
https://vuldb.com/submit/851347
https://vuldb.com/vuln/377112
https://vuldb.com/vuln/377112/cti

Get alerted when CVE-2026-15186 or the next vulnerability affects your stack