Read the docs

CoreUnion

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

CoreUnion records in CISA KEV

No CoreUnion vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-83130 CVE-2026-119656 · GHSA-c5ch-p933-jxhp

SQL injection in CoreShop order parameter lets attackers extract data

Priority HIGH 77

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00337 Published 2026-10-30 No fix listed CWE-89
TI-2026-83129 CVE-2026-119655 · GHSA-394c-r5mr-6r95

SQL injection in CoreShop GetGoodsPageList via order parameter

Priority MEDIUM 44

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00337 Published 2026-10-30 No fix listed CWE-89
TI-2026-70676 CVE-2026-108696 · GHSA-7jj7-hfg8-m26w

Authorization bypass in CoreShop lets customers act on others' orders

Priority LOW 23

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00222 Published 2026-10-11 No fix listed CWE-639
Open these records in search →