{"vulnerability": "cve-2026-102361", "sightings": [{"uuid": "cac69137-0969-4155-83bc-618833a44c25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102361", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwmqmhme5h2p", "content": "\ud83d\udea8 CVE-2026-102361 \u2014 CVSS 9.3 CRITICAL\n\nmall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-102361\n\n#CVE #PotatoSecurity #InfoSec", "creation_timestamp": "2026-09-29T02:07:26.753973Z"}, {"uuid": "7c58e4ca-d451-4f23-b898-f19eb1559e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-102361", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117351385362119175", "content": "CVE-2026-102361 in gz-yami mall4j (<=4.0): CRITICAL bug lets anyone reset any user password via PUT /user/updatePwd \ud83d\udee1\ufe0f. Enables account takeover and access to sensitive data. Patch ASAP! https://radar.offseq.com/threat/cve-2026-102361-missing-authentication-for-critical-function-in-gz-yami-mall4j-07dd220d69f425c2 #OffSeq #CVE2026102361 #infosec #ecommerce", "creation_timestamp": "2026-09-29T00:00:36.465702Z"}, {"uuid": "de8dfb69-59b0-4c25-8b13-ad5fb69f47b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-102361", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwmjjp4r5b2w", "content": "gz-yami mall4j (<=4.0) faces a CRITICAL flaw \u2014 unauthenticated attackers can reset any user password via the updatePwd endpoint. Account takeover risk: review controls and patch fast. https://radar.offseq.com/threat/cve-2026-102361-missing-authentication-for-critical-function-in-gz-yami-mall4j-07...", "creation_timestamp": "2026-09-29T00:00:38.172510Z"}, {"uuid": "290a78a3-4448-476f-a00d-93fd73d4e494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102361", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwmmc4yfv52l", "content": "CVE-2026-102361\nThe mall4j system (versions up to 4.0) lets anyone send a request to change a customer's password without first proving who they are. This means an attacker could take over any shopper\u2019s account and see orders\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-29T00:50:05.082140Z"}, {"uuid": "82295e36-7216-430b-b15b-27aaafd4710c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102361", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bc5fu6t5brywm", "content": "CVE-2026-102361 - mall4j through 4.0 Missing Authentication in Password Update Endpoint\nCVE ID : CVE-2026-102361\n \n Published : Sept. 28, 2026, 11:34 p.m. | 17\u00a0minutes ago\n \n Description : mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/upda...", "creation_timestamp": "2026-09-29T01:17:26.475971Z"}, {"uuid": "6c1db26d-fd25-49f8-b8e1-bd7becda7545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102361", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwmqm65uiq2o", "content": "\ud83d\udea8 CVE-2026-102361 \u2014 CVSS 9.3 CRITICAL\n\nmall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-102361\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-29T02:07:16.620936Z"}, {"uuid": "360e5be6-664e-4ab7-8897-5bcdfffd91bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102361", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwn7g2zhjg2d", "content": "\ud83d\udd34 CVE-2026-102361 - Critical (9.1)\n\nmall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd end...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-102361/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-29T06:32:19.529937Z"}]}