CVE-2025-5130: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Tmall Demo up to 20250505. It has been classified as critical. This affects the function uploadProductImage of the file tmall/admin/uploadProductImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely...

CVE-2025-5132: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Tmall Demo up to 20250505. It has been rated as problematic. This issue affects some unknown processing of the file tmall/admin/account/logout. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed t...

PT-2024-39105 · Unknown · Mini-Tmall

Name of the Vulnerable Software and Affected Versions: Mini-Tmall versions up to 20240901 Description: A critical issue was found in the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to SQL injection. It is possible to launch the...