CVE-2026-102365
- Source
- https://cve.org/CVERecord?id=CVE-2026-102365
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102365.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-102365
- Published
- 2026-09-28T23:34:29Z
- Modified
- 2026-09-30T08:05:00Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
- Details
-
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102365.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102365.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-102365
- https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authorization-in-admin-user-address-endpoints
- https://github.com/gz-yami/mall4j
- https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/UserAddrController.java#L46-L61
- https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A02_admin_useraddr_bfla.py
Affected packages
Git / github.com/gz-yami/mall4j
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102365.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"67860164633184014383760684265829188722",
"42501909667163602863054736059203563380",
"231728903954684254602606459241867689576",
"114908228088978152467191003178031489837",
"327544401581194744885245332117561519945",
"290716537883675564672815526817959014216",
"244352567336089811046452270280185237773",
"10065163174717105093597205462045980933"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-0093e010",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Transport.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"301109766061885803831418636668313973732",
"88505119894448127258449680105562896788",
"204450323617217596710906302912835394822",
"260987185811679200510741962207125812887",
"21031075997118309479674850728552928192"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-01126e02",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/xss/XssWrapper.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170329492573820207731061868046265207766",
"323521614757495907585222660917594524291",
"203168096964516867830447830612078618644",
"286254559581434165089421959083376668174",
"313561465388706282359516172596142834930",
"205855146118535440967540326342493045280",
"21311994223246375394188510773668508010",
"293096496841290118517298569826754442282",
"211777793217549449015393885180591730212",
"236851260720699085646532703720006775578",
"89144011929391222512996703993573323656",
"198679508569497850033070988715931791877",
"285526055507411243584085151492673647439",
"297434480796190883134939383978578057030",
"110349831218123746921303397868239815842",
"32668139193479792596291234234831799759",
"243183345934831505357970001210063638112",
"83769929201634579820908681288219989967",
"252531301653391719811668436681423017429",
"183477724550780364990151881662802784463",
"201718131262437669670414418659952784078",
"182023671041698907391693336717261558998",
"193493146424120173546887456273070223074",
"32923256917039000761873183972598241987"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-015ac9e7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/util/Json.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "258425076419855390225531983911619507569",
"length": 877
},
"id": "CVE-2026-102365-06f26a83",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/serializer/json/ImgJsonSerializer.java",
"function": "serialize"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"188089935996414838722885631734850279738",
"321462281667418462638012729530446128019",
"230232583090138126887907408130071659103",
"170828721334260119474912419376680944083",
"83345651879261626676319830739876734752",
"285485958019704128122809835001862634626"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-088c4fc1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/exception/YamiShopBindException.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290242786752278702788187022995682415477",
"167334392617019754866559979588217774091",
"188320384846084122777050714799521077337",
"251597373133414035099074420046338067274",
"144757007929540518448803509819547365979",
"118125292763721673202644574037989754921",
"283294622532658591325930834637014433663",
"244314184227635465739475019616396980674",
"143749543158835073088031434523842801130",
"305981086186965983726968660218895085481",
"57831055060890848623351449107232214370",
"314497516378380071000634371546234640552",
"257159603340047645152294853886379434098",
"301103982405445069880591012611627003341",
"217540390431720574888665524876705764489"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-09b04702",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24235960356762408481151873098449107948",
"270222908483367766323139995951925394683",
"127224554895140941270173949402275122644",
"267307360930378152415534599839737919424",
"310507772708311321086323998879391214189",
"311924979904434556672462608928860074892",
"267896715830886022936440193811650557864"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-0e65dfcf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/TranscityFree.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "35994193193622671978343325710993300979",
"length": 670
},
"id": "CVE-2026-102365-14fcd379",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/config/RedisCacheConfig.java",
"function": "redisSerializer"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"134595431431043258913574971917581273620",
"327280900193517922936994696567763983446",
"197478616468331867371177281138322525296",
"17041613803542884660166395449213637063",
"265754943159541638466869766714494148951",
"116491190737537360305527586476180199717",
"4109067189878709304857658378847167160",
"149461676589051993365770296823599423816",
"207485911532537107768611161439296280060",
"159278466814748516662348661682748657884",
"187019927149149823818273355789976320840"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-1c3d3b7f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/handler/HttpHandler.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "312905665211207923172922331863890412252",
"length": 801
},
"id": "CVE-2026-102365-1c70376d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/config/DefaultExceptionHandlerConfig.java",
"function": "methodArgumentNotValidExceptionHandler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172542124982409367390643620646121932490",
"98017927995834798881964566580575762711",
"290281817137846868905664377785984056050",
"66541841276848317517600378506657969745",
"197761590022396808627410924466281582292",
"65918897830609952997448703787476300483"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-20b325b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/OrderItem.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172542124982409367390643620646121932490",
"59748505119757864526826089986550070354",
"24304958222562504906457421897409640759",
"68247488213166402601614210204589985069",
"33441778475840970680654609595985975185",
"14768500149296352329334922793874050871",
"296688488709782299299390576594350162527"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-2bca95a1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysUserRole.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3476575608821870237461580211379252766",
"101093891514446649679022799909165255741",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-3a3e0670",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/BasketItemDto.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287288596133228507771237744182840484436",
"length": 1211
},
"id": "CVE-2026-102365-3d8210ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java",
"function": "doFilter"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"79232852935200949566949946859850229371",
"196782924361801994370364360344787022036",
"102744242019256303506093770650916471979",
"254672826927567100703601597240797218837",
"192265822126799538391252838870811620429",
"34536093395112350788745479380221719875",
"155324999921238541598921585437692754156",
"174458342356951526685598969875184120948"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-40438c4e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysMenu.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"66671481739388206739598897906438521056",
"61767912262412522285101033128669463541",
"84440829490520795933501777265233606216",
"10198737929313081990207056348826870282",
"197813886782614901047138314486429004725",
"38787237603848499063370261359700466206",
"162729310077084223271874512953346577643",
"282667778343238282191905607891133383082"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-41e7ec6f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Product.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"222128565019452547281640609442270616357",
"335339648938429803824554218873711433194",
"65376842701216430602139425994219423931",
"182089593163745867252882993079920398575",
"317334424381344099397315064174842570116",
"255928337351899410326583004785715675629",
"132354286816338514454488482768326242045",
"145058926915464866456192048671259740338",
"106647684650067780039667003713238798645",
"135788164687959031050266268472579697939",
"142214574335137789499933558200363293243",
"76092115524440837937968994454543264227",
"207474028115536312133677947089253539911"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-5297d321",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdComm.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "12454200127138889380311152391198202591",
"length": 756
},
"id": "CVE-2026-102365-58118e6e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/handler/HttpHandler.java",
"function": "printServerResponseToWeb"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"181622616876745818625794156012369877461",
"298548088878332749307830827807973501011",
"2977936422829128304814592648575183892",
"258941135407583476848140479984814896751",
"297866550303925996650887135215141797461"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-5d109855",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ShopDetail.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"334021840009879247581315768753024403724",
"123888199784086392601770907281005158009",
"60154089785194063425711284236563724812",
"311009030822188869436321106620080724522",
"136798732664950780894442091128995443680",
"124143297336050166780060478011543787555",
"230639923380358832698777385800359913722",
"100615913963939533823048023775291892575"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-5d62db6e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/config/DefaultExceptionHandlerConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83551807861501037584926975251999887717",
"50534897015676397959509493876597731522",
"106647684650067780039667003713238798645",
"80838917524837005853378255346292192658",
"72536226474482827436065856372428880353",
"264916905061244305047841804490394230202",
"315141870983922708280057204926196917443"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-63dea6ef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Order.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304620355501212156588851171715301460871",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-70d0df94",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/CategoryDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"102321462261863848627413018980340935316",
"163623463966179764819486833551798495311",
"278546863516451136661587803297018110147"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-7314d3b1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/util/IpHelper.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"312869628152696131523293135010924483555",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-82e5d739",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/dto/SearchProdDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172542124982409367390643620646121932490",
"59748505119757864526826089986550070354",
"331985901616535226673270973670473314879",
"192584708142535870522947776028726773632",
"199410375204071165950936207606573616577",
"287577134525495699132893853719460639245",
"125210133831932765945891939760974038693"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-86d7278e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysRoleMenu.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3476575608821870237461580211379252766",
"101093891514446649679022799909165255741",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-89a07cbb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProductItemDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"107608098972099137582780222058333648690",
"324356030093265683708903245115274147498",
"281138034028536639857225759664126578285",
"113390714014046033896457376053507291439",
"159513212726530089784797718729111124618",
"150491082977703362004908941800272097439",
"23000682524354102829309666648598759092",
"246531302237252046286643574688593070882"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-8a983b5c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysUser.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"19605288997970589853334452541550487973",
"135193004513013819707132490824286777723",
"187567584338183856901306808417471383847",
"85169012499537764184035352195459606609",
"324710882731639787645319627695939182804",
"189157649153753306922274202254116336666",
"308493969922832921575216057943703064758",
"81261880956910045870645043489987697935",
"94523449588369388649209538846182188346",
"120885254696010913921571395401596293270",
"142175594705389124197152395530324856945",
"109326209981439370123028066783496942977",
"146233333014576778400859571798175110789",
"39716991217218600820134826488196308288",
"9578547870774640135090176767202084162"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-91230c39",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/serializer/json/ImgJsonSerializer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10368374635493220267687595296410098764",
"78717422594131498984288409464515591457",
"267288592504382668774725096392819484802",
"333476444350976273187472310768459833168",
"129187394430235192020230702620700674088"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-93060e09",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-admin/src/main/java/com/yami/shop/admin/controller/OrderController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295632438189653856260646606186099187896",
"length": 399
},
"id": "CVE-2026-102365-93939374",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-admin/src/main/java/com/yami/shop/admin/controller/OrderController.java",
"function": "mergeIfNeed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"77633660919566992078695833508494038860",
"172034049187200615513561570059307895648",
"108984741007882726017722598770897408600",
"196500239672155147377346282120842552593",
"47097784198475938054367911898758255350",
"230379812567082776345476371209295180916"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-9601096c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdTag.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"308282593132653603774442944000802726557",
"152275842238481071334377665418150919899",
"11232567037795946619112874225186119058",
"101770132469175657616621679535154504512",
"37297662995804209606205392398127517367",
"97202307470797418456607080749927781007",
"136513966634841068054742010981418204232",
"14729314073850554449617528417899190119"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-9754a59d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysRole.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"32943374781213760990766010512141100414",
"66505387459589569356006981138888715745",
"29121830017112458242384967661059469914",
"283167827742623297825875045917692166089",
"227250925930175198122470856223996099757",
"290290463424663559683092528460362331444",
"215636278406406280247026375646136676146",
"96150391788161201613308306652826238675",
"240982110923350533452635207441197127562",
"232864641877429372006488862929182134940",
"257009697670537390793751988660822352694",
"144836894086069350296775825786564423107",
"84662796593078326893196002317430600933",
"216429329622261991523682894208667085398",
"274760188978922383557575633833059036929",
"127960708872721994518461147572797622746",
"170653872581478075287830997777187039811"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-a0e20d9d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/adapter/MallWebSecurityConfigurerAdapter.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"216049816715719615514921474197044262115",
"77633660919566992078695833508494038860",
"172034049187200615513561570059307895648",
"108984741007882726017722598770897408600",
"308398276615095796451389573962139829482",
"267929605365746820268658832454877149334",
"245205212829190636923996254943573481231",
"239373525359387919896016885422873952183"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-a34fa017",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/UserCollection.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170172224404750739593639930669503865489",
"269338347931263041487404331048389078261",
"230965119339732759660095102588655348020",
"84440829490520795933501777265233606216"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-a58e4bda",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Category.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"238599398720089304161423506447349593484",
"103259433584759310559484347680875870253",
"278839607862365852565083666447190071997",
"6304651884693683320042406262479135869",
"130697955646297447387621704654442373112",
"165629785668674846443906866175363318775",
"292993277036866162673860310351011349170",
"282225600283524634157787040148961878201"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-a69834a3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdProp.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"132354286816338514454488482768326242045",
"145058926915464866456192048671259740338",
"205934240089247581048444838174482206521",
"249568071644532351322130096425676951187",
"18524052080168150292323898784265982533",
"29556397104365850820393262677842919197",
"320223749986774597689616988599244774237"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-ad126461",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/UserAddr.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304620355501212156588851171715301460871",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-aef92661",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/MyOrderItemDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172542124982409367390643620646121932490",
"59748505119757864526826089986550070354",
"218426012673885552234996048937490921024",
"154713539139740336697180722737385157543",
"175439024215587716439841400023033703183",
"338180580188831341999299324087248797374",
"195258023582725886932539195863361270203"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-b2795bef",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdPropValue.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304620355501212156588851171715301460871",
"168891297852367452043978887195571100803",
"10695316654005116875961770282776455807",
"123414254493915838365702409943482620583",
"28437765685104550492784359714946810540",
"104383578165947816525692972724965564094",
"33347154866835222411207418813662225662",
"135450284319732494391570833481569764489"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-b3198b24",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/SkuDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"34392410626121516058530943868902858117",
"321690040681479456731471459681066029131",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-bc272d65",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProdCommDto.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "26285742671774494722272961410715801377",
"length": 177
},
"id": "CVE-2026-102365-bee1e2fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/util/Json.java",
"function": "toJsonString"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"311427082067284047029478078296629886161",
"137920542429536861889351934240659042256",
"103510659152712424800643303121582133484"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-c0327289",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-admin/src/main/java/com/yami/shop/admin/controller/ProdCommController.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"82113010221142541063461699340959246408",
"50534897015676397959509493876597731522",
"205934240089247581048444838174482206521",
"202958848831076701576459623010502659336",
"172400311080254621454479268877396918160",
"206846716141575347981650159544021929443",
"154024678845050241102924606240568734473"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-c388f951",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Notice.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83551807861501037584926975251999887717",
"50534897015676397959509493876597731522",
"205934240089247581048444838174482206521",
"19949611345289435190751599641358754579",
"159024571283313949542177834449658443246",
"208022896964032208621396948378890560842",
"138549378967914698585001066494711884760",
"220169485048651901457900208348211251387"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-c7ee03ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/User.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170816951571060875636601260752506838101",
"158864125561583775815450839089867419437",
"289170235437548692286889859244477652530",
"113953603053845971834565165619202597013",
"116295268231183902385997574251912633893"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-cb0460ed",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105909337512462528253456832239116988748",
"76928437112356489734738929554694295802",
"292190886556722086470060735038155701701",
"227223939613560252206030471953056890069",
"58171899356725319887368101465545864472",
"165430501936278024308101277059726406164",
"103564719863697867313237972847683653498",
"48829704085751514217529969932586881550"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-cc37ab46",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/TransfeeFree.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304620355501212156588851171715301460871",
"168891297852367452043978887195571100803",
"332141420746983287452269770097708213288",
"256616013166042480301744823603589402012",
"130441019161701041569445985492297964455",
"105806020708962975633999741324472412381",
"300671422190909498362192494995376038373",
"207784390102747196701519820560147336425",
"202731775657367034210343996102805364685",
"36998258253861336917786248181942798605"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-ccfa7976",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ShopCartItemDto.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "84854539216553177492401268332861701378",
"length": 196
},
"id": "CVE-2026-102365-ce7293b2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/xss/XssWrapper.java",
"function": "getAttribute"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"304620355501212156588851171715301460871",
"168891297852367452043978887195571100803"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-cf3c1145",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/IndexImgDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"216049816715719615514921474197044262115",
"77633660919566992078695833508494038860",
"172034049187200615513561570059307895648",
"108984741007882726017722598770897408600",
"296147412929932652731110764671152769045",
"296100603619772112709184845549868000061",
"70251836122907705940704742368371557297",
"147419772830006022021915320374697362203"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-d21bff7b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdTagReference.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105909337512462528253456832239116988748",
"76928437112356489734738929554694295802",
"292190886556722086470060735038155701701",
"6329649621081259504409322103986877589",
"264639134628607633131167717946173550799",
"182123013449938094495929112931610514719",
"29505993579327223548991514901093702284",
"203881320162433272298120933686522284739"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-d33e92df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Transfee.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154326765120279094986428182446841085191",
"length": 378
},
"id": "CVE-2026-102365-d7073f5f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/adapter/MallWebSecurityConfigurerAdapter.java",
"function": "filterChain"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105909337512462528253456832239116988748",
"76928437112356489734738929554694295802",
"292190886556722086470060735038155701701",
"3264396203755044131533532936214668358",
"233741894824397582009047169604780578208",
"223006285116554368910183919532550650704",
"18153874405055477978520248406343085096"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-d844e279",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/Area.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"246823188981971939269398278497590608953",
"137859232394428763282678285937157998624",
"139464201914128004868725625627586408329",
"263553643318542693169008601214750016915",
"39335036852747006829363257709035600850",
"279740499413153828999002254419961724458",
"212459109518408810275596752612027934823",
"250296793467462936751218517919644125825",
"329077704027228970460014076466817415756",
"292378120268717306007468947878378115778",
"318431918736029666634348320947621342771",
"281891563476150385274562148825946808871",
"221852499925484299951200124696641092740",
"240769926982575769736916093308040567376",
"69803567992983501686486320675722873826",
"121079260676954131762043488717586197377",
"111765342331142168648339797177069188290",
"146263268296006584873321235332209720703",
"107167011458428364595850915118797190403",
"199095337885723275580804472972829889247",
"46745100585661266261374465868423754927",
"209595050594754688565861747493500203660",
"231506109576117567140121383627769024401",
"191366124772524255499999629527718398190",
"153278312474071134802675965885767690299",
"166737724144449965654562636879563075996",
"5275144222023713077518024669604543575",
"157830414962571077258039778226447442892",
"327936571566039951810876728711627680265"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-dc2e1ce9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-common/src/main/java/com/yami/shop/common/config/RedisCacheConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"103756694176078512207942820024676311674",
"270108456957571745743328826520616524056",
"299043552706768234573488693141727860636",
"212552654583098442078866537190904826454",
"16588985636654395341013877572639228606",
"295889375138396607956329520267553851739",
"12015191441710280533212142141782547381",
"3379032855983755667255647477758554032",
"21183623698843120563553261634325992987",
"236069149630129787075845587074847273920"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-df19bbd1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-admin/src/main/java/com/yami/shop/admin/config/XxlJobConfig.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"144055157058886987942545591238999198941",
"327297196182523964961981826703599406781"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-efe9be7c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProductDto.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"172542124982409367390643620646121932490",
"98017927995834798881964566580575762711",
"290281817137846868905664377785984056050",
"233367603293819831524308359946815717042",
"39474640724379376039804981927468797851",
"152496739313212118783908842152898381216",
"81854970801679352675642856462233421528"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-f67690df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysLog.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170172224404750739593639930669503865489",
"269338347931263041487404331048389078261",
"230965119339732759660095102588655348020",
"84440829490520795933501777265233606216",
"10198737929313081990207056348826870282",
"290281817137846868905664377785984056050",
"78789637097246649405521841972692698005",
"215513932096726246268336018530437344902",
"230704392867133500001331217017974947251",
"179504713048775465266353140444335386124"
],
"threshold": 0.9
},
"id": "CVE-2026-102365-fbdf39bb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae",
"target": {
"file": "yami-shop-bean/src/main/java/com/yami/shop/bean/model/IndexImg.java"
}
}
]
vanir_signatures_modified
"2026-09-30T08:05:00Z"