Priority MEDIUM 57
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00338 · Published 2026-10-16 · No fix listed CWE-639
Priority MEDIUM 57
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00331 · Published 2026-10-16 · No fix listed CWE-863
Priority LOW 24
A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.0047 · Published 2026-09-13 · No fix listed CWE-79
Priority HIGH 75
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00239 · Published 2026-01-12 · No fix listed CWE-639
Priority MEDIUM 60
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00196 · Published 2025-11-29 · No fix listed CWE-79
Priority MEDIUM 61
A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00352 · Published 2025-08-04 · No fix listed CWE-312
Priority MEDIUM 57
A vulnerability was found in Exrick xboot up to 3.3.4.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00374 · Published 2025-08-04 · No fix listed CWE-918
Priority MEDIUM 57
A vulnerability was found in Exrick xboot up to 3.3.4.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00391 · Published 2025-08-04 · No fix listed CWE-284
Priority HIGH 70
A vulnerability was found in Exrick xboot up to 3.3.4.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00514 · Published 2025-08-04 · No fix listed CWE-200
Priority MEDIUM 50
Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-05-05 · No fix listed CWE-284
Priority HIGH 82
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00622 · Published 2025-04-15 · No fix listed CWE-269
Priority HIGH 82
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03348 · Published 2024-02-06 · No fix listed CWE-89
Priority LOW 29
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00842 · Published 2022-04-07 · No fix listed CWE-79
THREATIST.IORead the docs