Is CVE-2026-108784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108784 being exploited in the wild.

How severe is CVE-2026-108784?

Medium severity, with a CVSS score of 6.5, published 12 October 2026.

Is there a fix for CVE-2026-108784?

Yes: fixed in Commit dcaa93b3150352e5044708d7211b5bed0af4509f and later (payment amount retrieved from database order table instead of client input). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108784 attacked?

It is attacked over the network.

Am I affected by CVE-2026-108784?

Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108784: macrozheng mall payment business logic error in Alipay

CVE-2026-108784 · Severity: medium · CVSS 6.5 · Published 2026-10-12

The mall e-commerce platform used in online shopping systems contains a vulnerability in its Alipay payment processing that allows attackers to manipulate transaction amounts. An attacker can modify the payment amount in the request, causing the system to charge incorrect amounts—enabling fraud such as paying less than the actual purchase price or paying an arbitrary amount.

Technologies: Macrozheng Mall. Vendors: Macrozheng.

Quick answers

Is CVE-2026-108784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108784 being exploited in the wild.
How severe is CVE-2026-108784?: Medium severity, with a CVSS score of 6.5, published 12 October 2026.
Which products and versions are affected?: Macrozheng Mall up to 1.0.3.
Is there a fix for CVE-2026-108784?: Yes: fixed in Commit dcaa93b3150352e5044708d7211b5bed0af4509f and later (payment amount retrieved from database order table instead of client input). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108784 attacked?: It is attacked over the network.
Am I affected by CVE-2026-108784?: Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Commit dcaa93b3150352e5044708d7211b5bed0af4509f and later (payment amount retrieved from database order table instead of client input)

Technical details

A business logic vulnerability exists in AlipayServiceImpl.pay (AlipayServiceImpl.java) where the total_amount parameter is not validated against the order stored in the database, allowing direct manipulation of payment amounts. The vulnerability is remotely exploitable and requires no authentication. An attacker can change the payment amount transmitted to Alipay, resulting in financial discrepancies.

Affected products

macrozheng mall up to 1.0.3

Timeline

2026-10-12: disclosed: Vulnerability published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.