A vulnerability was found in macrozheng mall-swarm up to 1.0.3. It has been declared as critical. Affected is the function
delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization.
This vulnerability is documented as CVE-2025-14016. The attack can be executed remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
