CVE-2026-94045

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94045 newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94045 newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

EUVD-2026-83771

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94045

newbee-mall (up to 1.0.0) contains a persisted cross-site scripting vulnerability in the Goods Save Endpoint (controller/common/UploadController.java). The root cause is that ImageIO.read() performs a format-agnostic read, returning non-null for a polyglot PNG| payload and thereby bypassing the i...

PT-2026-96002

Name of the Vulnerable Software and Affected Versions newbee-ltd newbee-mall versions prior to 1.0.1 Description A remote cross site scripting issue exists in the Goods Save Endpoint within the controller/common/UploadController.java file. By manipulating the goodsName argument, an attacker can...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

The money-pos 1.0 software is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the backend fails to filter or escape the goodsName parameter during return processing, concatenating it directly into the order log description. The frontend then renders this co...

EUVD-2026-75158

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2026-71803: Improper Neutralization of Input During Web Page Generation

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

PT-2026-89152

money-pos 1.0 contains a stored Cross-Site Scripting XSS vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with...

CVE-2022-27476

A cross-site scripting XSS vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter...

CVE-2025-2087

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/goods/update. The manipulation of the argument goodsName leads to cross site scripting. The attack may be initiated remotely. The explo...

CVE-2025-2087

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/goods/update. The manipulation of the argument goodsName leads to cross site scripting. The attack may be initiated remotely. The explo...

PT-2025-10089

Name of the Vulnerable Software and Affected Versions StarSea99 starsea-mall version 1.0 Description A vulnerability has been found in StarSea99 starsea-mall, affecting some unknown processing of the file "/admin/goods/update". The manipulation of the argument goodsName leads to cross-site...

starsea-mall 代码注入漏洞

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A code injection vulnerability exists in starsea-mall version 1.0, which stems from improper manipulation of the goodsName parameter and could lead to cross-site scripting attacks...

CVE-2025-2087: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/goods/update. The manipulation of the argument goodsName leads to cross site scripting. The attack may be initiated remotely. The explo...