Live › vulnerability › CVE-2026-111660
Go to dashboardThe waynboot-mall shop application exposes an order callback endpoint, /callback/order/unpaid, that does not check authentication. An attacker can cancel any member's pending order and change product stock levels by guessing predictable order numbers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
This page as .md · .json · in your agent: get_signal("CVE-2026-111660")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.