Vendors / Exrick Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 1
Exploited now Exrick records in CISA KEV No Exrick vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00622 · Published 2025-04-15 · No fix listed CWE-269
Priority HIGH 82
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03348 · Published 2024-02-06 · No fix listed CWE-89
Priority HIGH 75
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
CVSS 3.1 HIGH 8.2· Network · No auth · No interaction · EPSS 0.00239 · Published 2026-01-12 · No fix listed CWE-639
Priority MEDIUM 60
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00196 · Published 2025-11-29 · No fix listed CWE-79
Priority MEDIUM 50
Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-05-05 · No fix listed CWE-284
Priority LOW 29
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00842 · Published 2022-04-07 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 1 9 0 0
THREATIST.IORead the docs