CVE-2025-10291
linlinjava litemall cancel WxAftersaleController improper authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 12, 2025
- Updated
- Sep 12, 2025
- Reserved
- Sep 11, 2025
Description
A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
litemalllinlinjava |
|
References
- VDB-323717 | linlinjava litemall cancel WxAftersaleController improper authorizationvdb-entrytechnical-description
- VDB-323717 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #643390 | linlinjava litemall latest broken function level authorizationthird-party-advisory
- https://www.cnblogs.com/aibot/p/19063376broken-linkexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.