CVE-2024-24112

The Exrick XMall e-commerce platform (v1.1 ) is vulnerable to a SQL injection vulnerability (CWE-89) through the orderDir parameter. Unauthenticated attackers can exploit this flaw to extract sensitive database information. The vulnerability has been reported as exploited in the wild and a proof-...

CVE-2025-28399

A security vulnerability in Erick xmall (versions 1.1 and earlier ) allows a remote attacker to perform a privilege escalation attack. The flaw is located specifically in the updateAddress method of the Address Controller class. Impacting the confidentiality, integrity, and availability of the sy...

CVE-2025-45612

The xmall e-commerce platform (v1.1) contains an incorrect access control vulnerability. An attacker can bypass authentication by sending a crafted GET request to the "/index" API endpoint. This flaw allows unauthorized access to the system. As a temporary workaround, users are advised to restric...

CVE-2021-43432

The CVE-2021-43432 entry concerns an XSS vulnerability in the Exrick XMall Admin Panel, exploitable via a GET parameter on the product-add.jsp page. Affected software is Exrick XMall Admin Panel; the vulnerability arises from improper handling of user-supplied input in that JSP, enabling script e...

CVE-2025-65540

The distributed e-commerce shopping mall xmall v1.1 contains multiple Cross-Site Scripting (XSS) vulnerabilities. The root cause is the improper handling of user-supplied data, where input fields such as username and description are directly rendered into HTML without sufficient sanitization or e...

CVE-2023-36331

The xmall distributed e-commerce shopping mall (version 1.1 ) contains an incorrect access control vulnerability in the /member/orderList API. An attacker can arbitrarily access other users' order details by manipulating the userId query parameter. Exploitation details are not provided, but the v...