Skip to content
Threat Feed
Subscribe

Product

Mall4j (<= 4.0)

1 brief RSS
critical advisory

Authentication Bypass in mall4j via Password Reset Endpoint

An unauthenticated remote code execution vulnerability in mall4j through 4.0 allows attackers to reset arbitrary storefront passwords via the PUT /user/updatePwd endpoint.

mall4j web-application authentication-bypass cve-2026-102361
1r 1t 1c