CVE-2026-79406

Name of the Vulnerable Software and Affected Versions macrozheng mall versions prior to 1.0.4

Description A business logic error exists that can be triggered remotely. The issue resides in the OmsCartItemServiceImpl.updateQuantity() function within the '/cart/update/quantity' endpoint. An attacker can exploit this by manipulating the quantity argument.

Recommendations Update macrozheng mall to version 1.0.4 or later. As a temporary workaround, restrict access to the '/cart/update/quantity' endpoint or monitor the quantity argument for unusual values.