CVE-2025-56161

The YOSHOP 2.0 e-commerce system contains an unauthenticated information disclosure vulnerability within the Goods module comment-list API endpoints. The root cause is that the Comment model eagerly loads the User model without applying field filters. Because the User.php file lacks $hidden or $v...

CVE-2025-56162

YOSHOP 2.0 is vulnerable to an unauthenticated SQL injection due to improper neutralization of special elements in the goodsIds parameter of the /api/goods/listByIds endpoint. The root cause is the getListByIds function, which concatenates user-supplied input into the orderRaw('field(goods_id, .....