{"schema_version":1,"title":"Gz-Yami Mall4j vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in Gz-Yami Mall4j: 0 in the last 7 days and 7 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108691, was published on 11 October 2026. Nothing in the last four weeks, down from 7 vulnerabilities in the four before. 0 critical against 1.","url":"https://junglewise.ai/threats/technologies/mall4j","json_url":"https://junglewise.ai/threats/technologies/mall4j.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mall4j","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":0,"all_time":7,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":7,"last_365_days":7},"latest":[{"cve":"CVE-2026-108691","cvss":5.4,"epss":0.0024,"slug":"cve-2026-108691-mall4j-through-4-0-contains-an-improper-authorization","title":"mall4j improper authorization in cart deletion","severity":"medium","exploited":false,"published_at":"2026-10-11T02:16:37.21+00:00","url":"https://junglewise.ai/threats/cve-2026-108691-mall4j-through-4-0-contains-an-improper-authorization"},{"cve":"CVE-2026-108690","cvss":4.3,"epss":0.0022,"slug":"cve-2026-108690-mall4j-through-4-0-contains-an-information-disclosure","title":"mall4j information disclosure via cart endpoint SQL injection","severity":"medium","exploited":false,"published_at":"2026-10-11T02:16:37.057+00:00","url":"https://junglewise.ai/threats/cve-2026-108690-mall4j-through-4-0-contains-an-information-disclosure"},{"cve":"CVE-2026-102367","cvss":5.4,"slug":"cve-2026-102367-mall4j-through-4-0-contains-an-insufficient-session-expiration","title":"mall4j insufficient session expiration in token refresh","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:04.06+00:00","url":"https://junglewise.ai/threats/cve-2026-102367-mall4j-through-4-0-contains-an-insufficient-session-expiration"},{"cve":"CVE-2026-102365","cvss":6.5,"slug":"cve-2026-102365-mall4j-through-4-0-fails-to-enforce-authorization-checks-on-get","title":"mall4j authorization bypass in UserAddrController endpoints","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.777+00:00","url":"https://junglewise.ai/threats/cve-2026-102365-mall4j-through-4-0-fails-to-enforce-authorization-checks-on-get"},{"cve":"CVE-2026-102364","cvss":5.4,"slug":"cve-2026-102364-mall4j-through-4-0-fails-to-validate-the-systype-field-in-sa","title":"mall4j session privilege escalation via sysType field","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-102364-mall4j-through-4-0-fails-to-validate-the-systype-field-in-sa"},{"cve":"CVE-2026-102362","cvss":5.3,"slug":"cve-2026-102362-mall4j-through-4-0-fails-to-implement-authentication-controls-on","title":"mall4j product review deletion auth bypass in ProdCommController","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.337+00:00","url":"https://junglewise.ai/threats/cve-2026-102362-mall4j-through-4-0-fails-to-implement-authentication-controls-on"},{"cve":"CVE-2026-102361","cvss":9.1,"slug":"cve-2026-102361-mall4j-through-4-0-contains-a-missing-authentication","title":"mall4j authentication bypass in password reset endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T00:17:03.183+00:00","url":"https://junglewise.ai/threats/cve-2026-102361-mall4j-through-4-0-contains-a-missing-authentication"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":1,"exploited":0,"vulnerabilities":5},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Gz-Yami Mall4j","slug":"mall4j","vendor":{"hub":true,"name":"Gz-Yami","slug":"gz-yami","url":"https://junglewise.ai/threats/vendors/gz-yami"},"aliases":[],"category":"e-commerce-platform","homepage":"https://www.mall4j.com","description":"E-commerce platform developed by gz-yami.","url":"https://junglewise.ai/threats/technologies/mall4j"},"most_severe":[{"cve":"CVE-2026-102361","cvss":9.1,"slug":"cve-2026-102361-mall4j-through-4-0-contains-a-missing-authentication","title":"mall4j authentication bypass in password reset endpoint","severity":"critical","exploited":false,"published_at":"2026-09-29T00:17:03.183+00:00","url":"https://junglewise.ai/threats/cve-2026-102361-mall4j-through-4-0-contains-a-missing-authentication"},{"cve":"CVE-2026-102365","cvss":6.5,"slug":"cve-2026-102365-mall4j-through-4-0-fails-to-enforce-authorization-checks-on-get","title":"mall4j authorization bypass in UserAddrController endpoints","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.777+00:00","url":"https://junglewise.ai/threats/cve-2026-102365-mall4j-through-4-0-fails-to-enforce-authorization-checks-on-get"},{"cve":"CVE-2026-108691","cvss":5.4,"epss":0.0024,"slug":"cve-2026-108691-mall4j-through-4-0-contains-an-improper-authorization","title":"mall4j improper authorization in cart deletion","severity":"medium","exploited":false,"published_at":"2026-10-11T02:16:37.21+00:00","url":"https://junglewise.ai/threats/cve-2026-108691-mall4j-through-4-0-contains-an-improper-authorization"},{"cve":"CVE-2026-102367","cvss":5.4,"slug":"cve-2026-102367-mall4j-through-4-0-contains-an-insufficient-session-expiration","title":"mall4j insufficient session expiration in token refresh","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:04.06+00:00","url":"https://junglewise.ai/threats/cve-2026-102367-mall4j-through-4-0-contains-an-insufficient-session-expiration"},{"cve":"CVE-2026-102364","cvss":5.4,"slug":"cve-2026-102364-mall4j-through-4-0-fails-to-validate-the-systype-field-in-sa","title":"mall4j session privilege escalation via sysType field","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-102364-mall4j-through-4-0-fails-to-validate-the-systype-field-in-sa"},{"cve":"CVE-2026-102362","cvss":5.3,"slug":"cve-2026-102362-mall4j-through-4-0-fails-to-implement-authentication-controls-on","title":"mall4j product review deletion auth bypass in ProdCommController","severity":"medium","exploited":false,"published_at":"2026-09-29T00:17:03.337+00:00","url":"https://junglewise.ai/threats/cve-2026-102362-mall4j-through-4-0-fails-to-implement-authentication-controls-on"},{"cve":"CVE-2026-108690","cvss":4.3,"epss":0.0022,"slug":"cve-2026-108690-mall4j-through-4-0-contains-an-information-disclosure","title":"mall4j information disclosure via cart endpoint SQL injection","severity":"medium","exploited":false,"published_at":"2026-10-11T02:16:37.057+00:00","url":"https://junglewise.ai/threats/cve-2026-108690-mall4j-through-4-0-contains-an-information-disclosure"}],"generated_at":"2026-11-10T03:07:00.198065+00:00"}