Vendor/product archive

exrick / xmall CVEs

Beta · best-effort

6 CVEs tagged to exrick / xmall — 3 Critical, 1 High, 2 Medium, 0 Low, 0 Unrated.

See this archive with more filters Back to exrick vendor archive

CVE-2023-36331

Published Jan 12, 2026

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userI…

CVSS 8.2 · High

Vendor/product tagsBeta · best-effort

CVE-2025-65540

Published Nov 29, 2025

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are dire…

CVSS 6.1 · Medium

Vendor/product tagsBeta · best-effort

CVE-2025-45612

Published May 5, 2025

Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2025-28399

Published Apr 15, 2025

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 16.4

Public PoC observed

Vendor/product tagsBeta · best-effort

CVE-2024-24112

Published Feb 6, 2024

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2021-43432

Published Apr 7, 2022

A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.

CVSS 6.1 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-6 of 6 CVEsPage 1 of 1