Newbee-mall_project Newbee-mall
14 CVEs affecting Newbee-mall_project Newbee-mall. Latest disclosed: 2026-02-12. Critical: 5, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26218 | Critical | 9.8 | 2026-02-12 | newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default passwor… |
CVE-2022-27477 | Critical | 9.8 | 2022-04-10 | Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. |
CVE-2020-23448 | Critical | 9.8 | 2021-01-26 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of t… |
CVE-2019-19113 | Critical | 9.8 | 2019-11-18 | main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. |
CVE-2026-26219 | Critical | 9.1 | 2026-02-12 | newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational… |
CVE-2024-48178 | High | 8.1 | 2024-10-28 | newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. |
CVE-2020-23449 | High | 7.5 | 2021-01-26 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized chang… |
CVE-2025-4259 | Medium | 6.3 | 2025-05-05 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall… |
CVE-2022-27476 | Medium | 6.1 | 2022-04-10 | A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2020-23447 | Medium | 6.1 | 2021-01-26 | newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write xss payload in their address information when buying goods, w… |
CVE-2023-30216 | Medium | 5.4 | 2023-05-04 | Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information. |
CVE-2025-10422 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySucces… |
CVE-2025-10423 | Low | 3.7 | 2025-09-15 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable capt… |
CVE-2025-1114 | Low | 3.5 | 2025-02-07 | A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component… |