CVE-2024-24112

XMall v1.1 is affected by a SQL injection via the orderDir parameter. Unauthenticated attackers can potentially exfiltrate data. The CVSSv3.1 base score is 9.8 (CRITICAL). Remediation: update Exrick XMall to a version newer than 1.1 (as indicated by sources in the connected documents).

CVE-2025-28399

CVE-2025-28399 affects Erick xmall v1.1 and earlier. The vulnerability enables a remote attacker to escalate privileges via the updateAddress method in the Address Controller class. Public metrics indicate a CVSS v3.1 base score of 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected pro...

CVE-2025-45612

CVE-2025-45612 affects Xmall v1.1. The issue is an incorrect access-control implementation that lets an attacker bypass authentication by sending a crafted GET request to /index. The CVE entry is rated CVSS 3.1 with a base score of 9.8 (CRITICAL); attack vector NETWORK, no user interaction requir...

CVE-2021-43432

The CVE-2021-43432 entry concerns an XSS vulnerability in the Exrick XMall Admin Panel, exploitable via a GET parameter on the product-add.jsp page. Affected software is Exrick XMall Admin Panel; the vulnerability arises from improper handling of user-supplied input in that JSP, enabling script e...

CVE-2023-36331

CVE-2023-36331 affects xmall v1.1. The /member/orderList API has improper access control that lets an attacker read other users’ order details by manipulating the userId query parameter. The CVSS 3.1 base score is 8.2 (NETWORK, LOW attack complexity, no privileges required, confidentiality impact...

CVE-2025-65540

The CVE-2025-65540 entry concerns XMall (xmall) v1.1 with multiple XSS vulnerabilities caused by improper handling of user-supplied data. User inputs (e.g., username, description) are rendered into HTML without proper sanitization or encoding, enabling script injection. Public references across N...