CVE-2026-108784

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108784
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108784.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108784
Published
2026-10-12T01:00:21Z
Modified
2026-10-28T11:06:15Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
Details

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-840"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108784.json"
}
References

Affected packages

Git / github.com/macrozheng/mall

Affected ranges

Type
GIT
Repo
https://github.com/macrozheng/mall
Events
Introduced
470c40eb1656485e53fa175afd7c05d506b42e02
Fixed
dcaa93b3150352e5044708d7211b5bed0af4509f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "last_affected": "1.0.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.0.1"
                },
                {
                    "last_affected": "1.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.0.2"
                },
                {
                    "last_affected": "1.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "1.0.3"
                },
                {
                    "last_affected": "1.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "dcaa93b3150352e5044708d7211b5bed0af4509f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108784.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "179643456709652125297185569904800424676",
                "264207904618224348539568295985753707591",
                "30879270233365273209061935051683473795",
                "187260706500736125208286535263569701115",
                "16965134910519273684834326339623394973",
                "14272794600468852640643021967715414804",
                "170520818621640150220727518430058086848",
                "129819981967227462313874579801828658363",
                "142177108417287222380555084617530686586",
                "94610251623494947873569117293845440486"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-108784-034bb135",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "140856672676074081720011023288069093118",
                "61311921588696638024373971681081532511",
                "72705844914815908492924304674851184231",
                "86212090098834922957523178019328281300",
                "219606914302098797457256763306951749399",
                "49610446923158333571861480720622892801",
                "332130855564299574743275535462436440166",
                "224889746348703264411446437930599281686",
                "215722503914556987624126170697433053082",
                "233200002975973743305757457663287171013",
                "29366404070774873366856313558756210740",
                "227887969972442337512251174217202926621",
                "160095420365934946791193997597125430216",
                "215722503914556987624126170697433053082",
                "233200002975973743305757457663287171013",
                "29366404070774873366856313558756210740",
                "326534213024523978823446886807293952506",
                "66897031272714680470781209407768400874"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-108784-1893e5db",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "282027662142645731721252105808824071208",
                "183643072123525369807080762997002883883",
                "287762359737696380349079568090657125197",
                "43949289299695804424313110398060938313"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-108784-1f609e48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/OmsPortalOrderService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "181834123095728459286916895948271664159",
            "length": 727
        },
        "id": "CVE-2026-108784-6bab5301",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java",
            "function": "webPay"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "246389757056110067904328968425293156550",
            "length": 736
        },
        "id": "CVE-2026-108784-8db4f871",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/impl/AlipayServiceImpl.java",
            "function": "pay"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "71750856364633401575120080708836087097",
            "length": 313
        },
        "id": "CVE-2026-108784-b6a3ca7c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f",
        "target": {
            "file": "mall-portal/src/main/java/com/macro/mall/portal/service/impl/OmsPortalOrderServiceImpl.java",
            "function": "paySuccessByOrderSn"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:15Z"