CVE-2023-36331: Exrick Xmall

High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days.

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Affected products

• Exrick Xmall: version 1.1 only

Published 2026-01-12. Last modified 2026-06-17.