mall4cloud vulnerabilities

CVEs whose affected-version data names the mall4cloud package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111615Medium· 6.5

yesterday

Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enu…

▾ Sunlitgz-yami · mall4cloudvia CVEORG