newbee-mall 代码注入漏洞

newbee-mall is a newbee open source e-commerce system . Newbee-mall 1.0 version of the code injection vulnerability exists , the vulnerability stems from the component Add Category Page file /admin/categories/save function save the parameter categoryName will lead to cross-site scripting attacks...

PT-2025-6011 · Unknown · Newbee-Mall

Name of the Vulnerable Software and Affected Versions: newbee-mall version 1.0 Description: A problematic issue has been found in newbee-mall. The save function of the /admin/categories/save API endpoint in the Add Category Page component is affected. The manipulation of the categoryName argument...

Compop Online Mall 3.5.3 Authentication Bypass Vulnerability

Exploit Title: Compop Online Mall Authentication Bypass Google Dork: Terms of Use inurl:compop.vip Exploit Author: dmlino Vendor Homepage: https://www.compop.ca/ Version: 3.5.3 CVE : CVE-2024-48445 Vulnerability Overview: The system uses a Unix timestamp "ts" parameter in URLs for authentication,...

CVE-2024-48445

An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters...

CVE-2024-48445

An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters...

CVE-2024-48445

An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters...

PT-2025-2798 · Unknown · Compop.Ca Online Mall

Name of the Vulnerable Software and Affected Versions: compop.ca ONLINE MALL version 3.5.3 Description: An issue in compop.ca ONLINE MALL allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. Recommendations: For compop.ca ONLINE MALL version 3.5.3, consider...

CVE-2024-48445

The CVE-2024-48445 entry affects compop.ca ONLINE MALL v3.5.3, where an arbitrary code execution vulnerability is exposed via URL parameters rid, tid, et, and ts. Descriptions across connected documents consistently identify the root cause as manipulation of these parameters in the application’s ...

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure...

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

CVE-2024-57432

macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve...

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator...

PT-2025-3442 · Unknown · Macrozheng Mall-Tiny

Name of the Vulnerable Software and Affected Versions: macrozheng mall-tiny version 1.0.1 Description: The issue allows an attacker to send null data through the resource creation interface, resulting in a null pointer dereference in all subsequent operations that require authentication. This...

CVE-2024-57434

CVE-2024-57434 affects Macrozheng Mall-Tiny 1.0.1 and is caused by an Incorrect Access Control vulnerability where the project imports users by default and a test user is granted super administrator privileges. Reported with CVSS 3.1: AV=N, AC=L, PR=L, UI=N, S=U, C/H/I/A = High. Exploitation stat...

CVE-2024-57432

The CVE-2024-57432 entry concerns macrozheng mall-tiny 1.0.1 with insecure permissions due to hardcoded JWT signing keys. The JWT contains user information and is used for privilege management, enabling forging of arbitrary users’ tokens and authentication bypass. Concrete details across connecte...

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state...

CVE-2024-57435

CVE-2024-57435 affects macrozheng mall-tiny 1.0.1. The issue arises when an attacker can send null data through the resource creation interface, causing a null pointer dereference that affects all subsequent operations requiring authentication, leading to denial of service and service restart fai...

mall-tiny 安全漏洞

mall-tiny is a rapid development scaffolding for macro individual developers. A security vulnerability exists in mall-tiny version 1.0.1, which stems from the vulnerability to incorrect access control via the logout feature...