CVE-2025-13115CWE-266CWE-285

CVE-2025-13115

Medium · published November 13, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2025-11-13T19:15Z
Affected products (2)
ProductVersionsFixed in
macrozheng/mall≤ 1.0.3—
macrozheng/mall-swarm≤ 1.0.3—
References (7)
https://github.com/Hwwg/cve/issues/11 · [email protected]https://github.com/Hwwg/cve/issues/6 · [email protected]https://vuldb.com/?ctiid.332320 · [email protected]https://vuldb.com/?id.332320 · [email protected]https://vuldb.com/?submit.683222 · [email protected]https://vuldb.com/?submit.686528 · [email protected]https://github.com/Hwwg/cve/issues/6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 NOV 13:32Z
    macrozheng mall-swarm/mall Order Details detail improper authorization
    cvelistv5