These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was found in macrozheng mall up to 1.0.3, affecting the JwtAuthenticationTokenFilter's refreshToken functionality. This issue, caused by improper session expiration in JwtTokenUtil.refreshHeadToken, can lead to session expiration. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The attack may be initiated remotely, and a patch has been provided.
A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identif [truncated]
CVE-2026-82364 is a race condition vulnerability in macrozheng mall up to 1.0.3, impacting the /order/submit function. The vulnerability allows for remote attacks with high complexity and difficult exploitability. Users of macrozheng mall up to version 1.0.3 should verify their installations and apply patches if available to prevent potential remote attacks. The vendor deleted the GitHub issue for this vu [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-09T18:16:42.930Z and has not been modified since then. The vulnerability affects macrozheng mall 0504e86, specifically in the /sso/getAuthCode file of the mall-portal module, potentially leading to weak password recovery. The attack may be launched remotely with high complexity and difficult exploit [truncated]
A medium-severity improper authorization vulnerability exists in macrozheng mall versions up to 1.0.3. The vulnerability resides in the Super Admin Password Handler component, specifically affecting the /admin/update/ endpoint. Remote exploitation is possible through manipulation of this endpoint, allowing an attacker with high privileges to bypass intended authorization controls. The CVSS 4.0 vector indi [truncated]
CVE-2026-25858 is a critical authentication vulnerability in macrozheng mall version 1.0.3 and prior. The vulnerability allows unauthenticated attackers to reset arbitrary user account passwords using only a victim's telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a valu [truncated]