Macrozheng vulnerabilities
We track 6 vulnerabilities in Macrozheng products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 7, 2026.
Latest Macrozheng vulnerabilities
- 9.8 Critical severity
mall: Weak Password Recovery Mechanism for Forgotten Password
macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password r
- 8.1 High severity
mall-swarm: Incorrect Authorization
A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely.
- 8.8 High severity
Mall-tiny: Incorrect Authorization
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator.
- 7.5 High severity
Mall-tiny: Improper Access Control
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state.
- 7.5 High severity
Mall-tiny: Improper Authentication
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge t
- 8.1 High severity
mall: Use of Default Cryptographic Key
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The comple