Vulnerability · Published Nov 20, 2025 · Assigned by VulDB
CVE-2025-13443macrozheng mall delete access control
Medium 5.4
In plain English
A medium-severity improper access control in mall from macrozheng. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 83.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| macrozheng | mall | 1.0.01.0.11.0.21.0.3 |
Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-333016 | macrozheng mall delete access control vdb-entry, technical-description
- VDB-333016 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #690892 | mall <=1.0.3 Improper Control of Resource Identifiers third-party-advisory
- https://github.com/Hwwg/cve/issues/15 exploit, issue-tracking