Exrick XMall - SQL Injection

XMall v1.1 was discovered to contain a SQL injection vulnerability via the 'orderDir' parameter. id: CVE-2024-24112 info: name: Exrick XMall - SQL Injection author: DhiyaneshDk severity: critical description: | XMall v1.1 was discovered to contain a SQL injection vulnerability via the 'orderDir'...

VulnCheck KEV: CVE-2024-24112

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter...

CVE-2026-90571

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2026-90571

Exrick xmall , an open-source e-commerce platform, is affected by a Cross-Site Scripting (XSS) vulnerability in the Order Printing component. The flaw resides in the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, where manipulation of an unknown function allows remote exploit...

CVE-2026-90571 Exrick xmall Order Printing order-print.jsp cross site scripting

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

EUVD-2026-77052

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2026-90571 Exrick xmall Order Printing order-print.jsp cross site scripting

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2026-90571 Exrick xmall Order Printing order-print.jsp cross site scripting

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

PT-2026-90876

Name of the Vulnerable Software and Affected Versions Exrick xmall versions up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c Description An issue exists in the Order Printing component within the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp. A manipulation of an unknown functi...

CVE-2026-90571: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

CVE-2023-36331: Authorization Bypass Through User-Controlled Key

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

EUVD-2023-40299

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

PT-2026-2300

Name of the Vulnerable Software and Affected Versions xmall version 1.1 Description An issue exists in xmall version 1.1 related to access control. Specifically, the /member/orderList API endpoint allows unauthorized access to other users' order details. This is achieved by manipulating the userI...

xmall security vulnerabilities

XMall is a distributed e-commerce shopping mall based on SOA architecture by the individual developer of Exrick. A security vulnerability exists in version 1.1 of xmall, which stems from improper access control of the /member/orderList API, and could lead to an attacker accessing other users' ord...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

CVE-2023-36331

The xmall distributed e-commerce shopping mall (version 1.1 ) contains an incorrect access control vulnerability in the /member/orderList API. An attacker can arbitrarily access other users' order details by manipulating the userId query parameter. Exploitation details are not provided, but the v...

CVE-2025-65540

Multiple Cross-Site Scripting XSS vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious...