CVE-2026-111660 is a missing authentication vulnerability in waynboot-mall through version 2.0.0, allowing unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. This vulnerability enables attackers to submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels. Defen [truncated]
CVE-2026-111659 is a missing authentication vulnerability in Waynboot-mall through version 2.0.0, allowing unauthenticated attackers to forge orders via the /callback/order/submit endpoint. This could lead to unauthorized order creation, exposure of stored shipping details, cart clearing, and stock decrement. The vulnerability is caused by a missing authentication mechanism in the /callback/order/submit e [truncated]
