CVE-2025-13118

MEDIUM 6.3

macrozheng mall-swarm paySuccess improper authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

12th

A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-285 CWE-266
Vendor	macrozheng
Product	mall-swarm
Published	Nov 13, 2025
Last Updated	May 23, 2026

Stay Ahead of the Next One

Get instant alerts for macrozheng mall-swarm

Be the first to know when new medium vulnerabilities affecting macrozheng mall-swarm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

macrozheng / mall-swarm

1.0.0 1.0.1 1.0.2 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/332323 vuldb.com: https://vuldb.com/vuln/332323/cti vuldb.com: https://vuldb.com/submit/683345 vuldb.com: https://vuldb.com/submit/686531 github.com: https://github.com/Hwwg/cve/issues/9 github.com: https://github.com/Hwwg/cve/issues/14

Credits

🔍 huangweigang (VulDB User) VulDB CNA Team