Medium severity · published Nov 13, 2025
CVE-2025-13115
macrozheng mall-swarm/mall Order Details detail improper authorization
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall · macrozheng
1.0.0; 1.0.1; 1.0.2; 1.0.3 · source: vendor, NVD
MA
mall-swarm · macrozheng
1.0.0; 1.0.1; 1.0.2; 1.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13115
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13115
Exploit
https://github.com/Hwwg/cve/issues/11
Exploit
https://github.com/Hwwg/cve/issues/6
Permissions Required
https://vuldb.com/?ctiid.332320
Third Party Advisory
https://vuldb.com/?id.332320
Third Party Advisory
https://vuldb.com/?submit.683222
Third Party Advisory
https://vuldb.com/?submit.686528
More from mall
9.1
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure
8.1
CVE-2024-11619
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3
6.5
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
6.5
CVE-2025-13443
macrozheng mall delete access control
6.3
CVE-2026-108785
macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration