gz-yami mall4j

• CVE-2026-108691 Medium 5.4 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList 0.2%
• CVE-2026-108690 Medium 4.3 mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList 0.2%
• CVE-2026-102367 Medium 5.4 mall4j through 4.0 Insufficient Session Expiration via Token Refresh 0.2%
• CVE-2026-102366 Medium 4.4 mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints 0.2%
• CVE-2026-102365 Medium 6.5 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints 0.2%
• CVE-2026-102364 Medium 5.4 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API 0.2%
• CVE-2026-102363 Low 3.7 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number 0.3%
• CVE-2026-102362 Medium 5.3 mall4j through 4.0 Missing Authentication in Product Review Deletion 0.3%
• CVE-2026-102361 Critical 9.1 mall4j through 4.0 Missing Authentication in Password Update Endpoint 0.4%