CVE-2026-82423

Name of the Vulnerable Software and Affected Versions macrozheng mall versions prior to 1.0.4

Description A remote issue exists in the Payment Status Endpoint component within the /order/paySuccess file. Manipulation of the orderId argument allows an attacker to enforce a behavioral workflow.

Recommendations Update macrozheng mall to version 1.0.4 or later. As a temporary mitigation, restrict access to the /order/paySuccess endpoint or avoid using the orderId parameter until the update is applied.