CVE-2026-15186

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15186

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15186.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15186

Published

2026-07-09T13:15:08.296Z

Modified

2026-07-15T01:49:14.943750647Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

macrozheng mall Portal Endpoint create resource injection

Details

A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-99"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15186.json"
}

References

Affected packages

Git / github.com/macrozheng/mall

Affected ranges

Type

GIT

Repo

https://github.com/macrozheng/mall

Events

Introduced

470c40eb1656485e53fa175afd7c05d506b42e02

Last affected

dd617ac3fe89c8083af56bee3364b1e812cda3ed

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15186.json"