CVE-2024-8568

Mini-Tmall is affected by a SQL injection in the function RewardMapper.select inside tmall/admin/order/1/1, triggered by manipulating the orderBy argument. Affected versions are up to 20240901. Exploitation is remote and has been disclosed publicly; vendor contact occurred with no evident respons...

CVE-2025-5135

CVE-2025-5135 affects Tmall Demo up to 20250505. The vulnerability is an XSS in the Product Details Page, triggered by manipulating the Product Name/Product Title in the file path /tmall/admin/. The issue concerns some unknown functionality of that admin path and is exploitable remotely; the expl...

CVE-2024-40554

The Tmall_demo software (specifically version v2024.07.03 ) contains an access control issue that allows an attacker to obtain sensitive information . This vulnerability is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The impact is characterized as a high ...

CVE-2025-1843

CVE-2025-1843 affects Mini-Tmall up to 20250211. The issue lies in the file com/xq/tmall/dao/ProductMapper.java, in the select function where manipulating the argument orderBy enables an SQL injection. The vulnerability can be triggered remotely, and the exploit has been disclosed publicly. Multi...

CVE-2025-5131

CVE-2025-5131 affects Tmall Demo (up to 20250505). The issue is in the uploadCategoryImage function (tmall/admin/uploadCategoryImage) where improper handling of the File argument enables unrestricted file upload. This vulnerability can be exploited remotely; the exploit has been disclosed publicl...

CVE-2025-5136

CVE-2025-5136 affects Tmall Demo up to 20250505 in the Payment Identifier Handler, specifically the file path /tmall/order/pay/. The root issue is insufficiently random values in the payment identifier, enabling remote attack; attack vector is NETWORK with HIGH complexity and NONE authentication....

CVE-2024-40560

The Mini-Tmall (also referred to as Tmall_demo ) application, a Spring Boot-based mall template, is vulnerable to SQL injection in versions prior to v2024.07.03 . The root cause is a lack of validation for externally entered SQL statements. An attacker can exploit this flaw to execute illegal SQL...

CVE-2024-40553

Tmall_demo version v2024.07.03 is vulnerable to an arbitrary file upload via the uploadUserHeadImage component. This vulnerability (CWE-434) allows an attacker to upload files of dangerous types, potentially leading to a compromise of system integrity. To mitigate this risk, it is recommended to ...

CVE-2025-5132

CVE-2025-5132 affects Tmall Demo up to 20250505, exposing a cross-site request forgery in the file tmall/admin/account/logout. The CSRF arises from misuse of this logout endpoint and can be triggered remotely; exploitation has been disclosed publicly. Affected/general details are not version-scop...

CVE-2024-40555

The software Tmall_demo version 2024.07.03 is vulnerable to an arbitrary file upload vulnerability (CWE-434). This flaw could potentially lead to unauthorized access or other malicious activity . At this time, there is no information regarding a newer version that contains a fix for this issue. E...

CVE-2025-5130

CVE-2025-5130 affects Tmall Demo up to 20250505, specifically the uploadProductImage function in tmall/admin/uploadProductImage. The root cause is manipulation of the File argument enabling unrestricted image uploads, with remote exploitation possible and public disclosure of the exploit. Version...

CVE-2025-5134

CVE-2025-5134 affects Tmall Demo up to 20250505, specifically the Buy Item Page’s Detailed Address parameter, enabling cross-site scripting. Exploitable remotely; exploit disclosed publicly. No version details or patch information provided in the sources; some reports suggest restricting the Deta...

CVE-2025-5133

CVE-2025-5133 concerns Tmall Demo up to 20250505, affecting the Search Box component. The vulnerability is a cross-site scripting (XSS) issue caused by a misbehavior of an unknown function in the Search Box, enabling remote exploitation. The exploit has been publicly disclosed; no affected versio...