Vulnerabilities

TI-2026-21210 CVE-2026-26219 · GHSA-r8m3-w58q-qp9h

newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking

MEDIUM 47

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00227 Published 2026-02-12 No fix listed CWE-327

TI-2026-21209 CVE-2026-26218 · GHSA-3qgp-4ccx-9wvf

newbee-mall Default Seeded Administrator Credentials Allow Account Takeover

MEDIUM 48

newbee-mall includes pre-seeded administrator accounts in its database initialization script.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00436 Published 2026-02-12 No fix listed CWE-798

TI-2025-09556 CVE-2025-10423 · GHSA-7p3m-6gm8-fpwm

newbee-mall kaptcha mallKaptcha Captcha

MEDIUM 61

A vulnerability was found in newbee-mall 1.0.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00452 Published 2025-09-15 No fix listed CWE-287

TI-2025-09555 CVE-2025-10422 · GHSA-mr72-5f4p-ffjh

newbee-mall Order Status paySuccess improper authorization

MEDIUM 57

A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00297 Published 2025-09-15 No fix listed CWE-266

TI-2025-03790 CVE-2025-4259 · GHSA-jfrx-g95w-9254

newbee-mall UploadController.java upload unrestricted upload

MEDIUM 57

A vulnerability has been found in newbee-mall 1.0 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00544 Published 2025-05-05 No fix listed CWE-284

TI-2025-00946 CVE-2025-1114 · GHSA-p5rq-5qmf-cpr9

newbee-mall Add Category Page save cross site scripting

MEDIUM 56

A vulnerability classified as problematic has been found in newbee-mall 1.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00338 Published 2025-02-07 No fix listed CWE-79

TI-2024-32293 CVE-2024-48178 · GHSA-8c74-r7ww-5v4x

newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.

HIGH 70

newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00338 Published 2024-10-28 No fix listed CWE-918

TI-2023-14181 CVE-2023-30216 · GHSA-5jrm-j79m-qqvm

Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy…

MEDIUM 58

Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00329 Published 2023-05-04 No fix listed CWE-639

TI-2022-10492 CVE-2022-27477 · GHSA-grh8-79wc-px6h

Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.

MEDIUM 44

Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01105 Published 2022-04-10 No fix listed CWE-434

TI-2022-10491 CVE-2022-27476 · GHSA-r249-7c63-4pf8

A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0…

LOW 28

A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00555 Published 2022-04-10 No fix listed CWE-79

TI-2020-14560 CVE-2020-23449 · GHSA-9fg6-4jc3-m2x8

newbee-mall all versions are affected by incorrect access control to remotely gain…

LOW 35

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00879 Published 2021-01-26 No fix listed CWE-639

TI-2020-14559 CVE-2020-23448 · GHSA-rf85-wq6p-mgqc

newbee-mall all versions are affected by incorrect access control to remotely gain…

MEDIUM 45

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01596 Published 2021-01-26 No fix listed CWE-306

TI-2020-14558 CVE-2020-23447 · GHSA-69r7-j2w2-g279

newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle.

LOW 28

newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00668 Published 2021-01-26 No fix listed CWE-79

TI-2019-13795 CVE-2019-19113 · GHSA-xxhm-2g3m-gv88

main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before…

MEDIUM 46

main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01838 Published 2019-11-18 No fix listed CWE-89

Vulnerabilities

Filters