CVE-2026-15186: macrozheng mall Portal Endpoint create resource injection
A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15186?
The severity of CVE-2026-15186 is rated as medium with a score of 6.3.
How do I fix CVE-2026-15186?
To fix CVE-2026-15186, update the macrozheng mall Portal Endpoint to a version beyond 1.0.3 where the vulnerability is patched.
What components are affected by CVE-2026-15186?
CVE-2026-15186 affects the Portal Endpoint component of the macrozheng mall software.
What type of attack can be executed due to CVE-2026-15186?
CVE-2026-15186 allows for remote exploitation through resource injection due to improper control of resource identifiers.
In which version of macrozheng mall was CVE-2026-15186 identified?
CVE-2026-15186 was identified in the macrozheng mall Portal Endpoint up to version 1.0.3.