Xmall

xmall

Vendor: Exrick • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-36331 1Exrick 1Xmall Jun 17, 2026 Jan 12, 2026 N/A· v4 8.2 HIGH· v3 N/A· v2 Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
CVE-2025-65540 1Exrick 1Xmall Jun 17, 2026 Nov 29, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sa...Show more Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.Show less
CVE-2025-45612 1Exrick 1Xmall Jun 17, 2026 May 5, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.
CVE-2025-28399 1Exrick 1Xmall Jun 17, 2026 Apr 15, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
CVE-2024-24112 1Exrick 1Xmall Jun 17, 2026 Feb 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2021-43432 1Exrick 1Xmall Jul 9, 2026 Apr 7, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.