Mall-tiny vulnerabilities

3 known vulnerabilities in Mall-tiny from Macrozheng. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Mall-tiny: Incorrect Authorization

  CVE-2024-57434Jan 31, 2025Macrozheng

  macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator.

• 7.5 High severity

  Mall-tiny: Improper Access Control

  CVE-2024-57433Jan 31, 2025Macrozheng

  macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state.

• 7.5 High severity

  Mall-tiny: Improper Authentication

  CVE-2024-57432Jan 31, 2025Macrozheng

  macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge t