Exrick

exrick

10 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (10)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-36331 1Exrick 1Xmall Jun 17, 2026 Jan 12, 2026 N/A· v4 8.2 HIGH· v3 N/A· v2 Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
CVE-2025-65540 1Exrick 1Xmall Jun 17, 2026 Nov 29, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sa...Show more Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.Show less
CVE-2025-8528 1Exrick 1Xboot Jun 17, 2026 Aug 4, 2025 2.9 LOW· v4 5.9 MEDIUM· v3 2.6 LOW· v2 A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive in...Show more A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.Show less
CVE-2025-8527 1Exrick 1Xboot Jun 17, 2026 Aug 4, 2025 2.1 LOW· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/Securit...Show more A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagger. The manipulation of the argument loginUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2025-8526 1Exrick 1Xboot Jun 17, 2026 Aug 4, 2025 2.1 LOW· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/...Show more A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2025-8525 1Exrick 1Xboot Jun 17, 2026 Aug 4, 2025 5.5 MEDIUM· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclos...Show more A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2025-45612 1Exrick 1Xmall Jun 17, 2026 May 5, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.
CVE-2025-28399 1Exrick 1Xmall Jun 17, 2026 Apr 15, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
CVE-2024-24112 1Exrick 1Xmall Jun 17, 2026 Feb 6, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2021-43432 1Exrick 1Xmall Jul 9, 2026 Apr 7, 2022 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.