CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-102361 — mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u...

·Source: NIST NVD

Updated:

Executive Summary

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

Analysis

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data. CVSS Score: 9.1. Published: 2026-09-29T00:17:03.183.

Indicators of Compromise (1)

CVE (1)
CVE-2026-102361
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Visa and Lloyds complete live trials of stablecoin settlement

Visa and Lloyds Banking Group have completed a live pilot exploring how stablecoin-based settlement could support faster, more transparent and flexible cross-border transactions.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-102458 — EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. U...

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

CVE-2026-102458
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-102455 — EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability....

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

CVE-2026-102455
NIST NVD