CVE-2026-108784

MEDIUM 6.5

macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.

CWE	CWE-840
Vendor	macrozheng
Product	mall
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for macrozheng mall

Be the first to know when new medium vulnerabilities affecting macrozheng mall are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

macrozheng / mall

1.0.0 1.0.1 1.0.2 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416563 vuldb.com: https://vuldb.com/vuln/416563/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108784 vuldb.com: https://vuldb.com/submit/959283 github.com: https://github.com/macrozheng/mall/issues/998 github.com: https://github.com/macrozheng/mall/commit/dcaa93b3150352e5044708d7211b5bed0af4509f github.com: https://github.com/macrozheng/mall/

Credits

🔍 mjh_123 (VulDB User)