CVE-2023-36331

High

Published: 12/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Risk Assessment

The vulnerability allows unauthorized access to other users' order data, potentially leading to privacy breaches and customer data leakage.

Recommendation

It is recommended to implement proper access control at the API level to ensure users can only access their own orders.

Other vulnerabilities in xmall

CVE-2025-65540Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. Fields such as username and description are rendered directly into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.

Original NVD description (English source)

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS