Vendors / Newbee-mall Project Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 2
Exploited now Newbee-mall Project records in CISA KEV No Newbee-mall Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 70
newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00338 · Published 2024-10-28 · No fix listed CWE-918
Priority MEDIUM 61
A vulnerability was found in newbee-mall 1.0.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00452 · Published 2025-09-15 · No fix listed CWE-287
Priority MEDIUM 58
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00329 · Published 2023-05-04 · No fix listed CWE-639
Priority MEDIUM 57
A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00297 · Published 2025-09-15 · No fix listed CWE-266
Priority MEDIUM 57
A vulnerability has been found in newbee-mall 1.0 and classified as critical.
CVSS 4.0 MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00544 · Published 2025-05-05 · No fix listed CWE-284
Priority MEDIUM 56
A vulnerability classified as problematic has been found in newbee-mall 1.0.
CVSS 4.0 MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00338 · Published 2025-02-07 · No fix listed CWE-79
Priority MEDIUM 48
newbee-mall includes pre-seeded administrator accounts in its database initialization script.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00426 · Published 2026-02-12 · No fix listed CWE-798
Priority MEDIUM 47
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00222 · Published 2026-02-12 · No fix listed CWE-327
Priority MEDIUM 46
main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01838 · Published 2019-11-18 · No fix listed CWE-89
Priority MEDIUM 45
newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01596 · Published 2021-01-26 · No fix listed CWE-306
Priority MEDIUM 44
Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01105 · Published 2022-04-10 · No fix listed CWE-434
Priority LOW 35
newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00879 · Published 2021-01-26 · No fix listed CWE-639
Priority LOW 28
A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00555 · Published 2022-04-10 · No fix listed CWE-79
Priority LOW 28
newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00668 · Published 2021-01-26 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
5 2 7 0 0
THREATIST.IORead the docs