6 matches found
CVE-2026-119656
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...
CVE-2026-119656 CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...
CVE-2026-119656
CoreShop by CoreUnion (versions through 1.5.5 ) is vulnerable to an unauthenticated SQL Injection in the api/Agent/GetGoodsPageList endpoint. The flaw exists in the order parameter, which is appended to an ORDER BY clause. Attackers can inject subqueries that bypass SqlSugar's field check to extr...
EUVD-2026-114072
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...
CVE-2026-119656: CoreUnion CoreShop: CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the…
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...
PT-2026-133586
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...