CVE-2025-4136 — Weitong Mall Sale Endpoint improper authorization

Back Back to CVE browser

MEDIUM

Weitong Mall Sale Endpoint improper authorization

Published Apr 30, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.36%

Description

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Weitong Product Mall Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Weitong

Mall

n/a

Version	Status	Constraints
1.0.0	affected	-

Remediation

No remediation recorded yet.

Metrics

0.36% 0.00361

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00361

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.36% (0.00361)	27.54th	v5 (v2026.06.15)
Jun 15, 2026	0.29% (0.00291)	20.56th	v5 (v2026.06.15)
May 1, 2025	0.03% (0.00034)	8.34th	v4 (v2025.03.14)

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (4)

https://vuldb.com/?ctiid.306627
signaturepermissions-required
https://vuldb.com/?id.306627
vdb-entrytechnical-description
https://vuldb.com/?submit.560782
third-party-advisory
https://www.cnblogs.com/aibot/p/18830909
exploit

Link	Providers	Tags
https://vuldb.com/?ctiid.306627		signaturepermissions-required
https://vuldb.com/?id.306627		vdb-entrytechnical-description
https://vuldb.com/?submit.560782		third-party-advisory
https://www.cnblogs.com/aibot/p/18830909		exploit