Phpshe

14 CVEs across 2 Phpshe products. Browse Phpshe vulnerabilities, severities, and proof-of-concept exploits.

Phpshe products with known CVEs

ProductCVEs
Phpshe13
Mall System1
Phpshe CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-3554Medium4.32025-04-14A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. T…
CVE-2025-3553Medium6.32025-04-14A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&a…
CVE-2022-24132High7.52022-03-30phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service.
CVE-2020-18020Critical9.82021-04-28SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a craft…
CVE-2020-18215High8.82021-02-09Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remot…
CVE-2020-19165Critical9.82020-12-11PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter.
CVE-2019-9762Critical9.82019-03-14A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
CVE-2019-9761High7.52019-03-14An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs be…
CVE-2019-9626Critical9.82019-03-07PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php.
CVE-2019-6708High7.22019-01-23PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.
CVE-2019-6707High7.22019-01-23PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.
CVE-2018-18486Critical9.82018-10-18An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter.
CVE-2018-18485High7.52018-10-18An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbna…
CVE-2018-8943Critical9.82018-03-22There is a SQL injection in the PHPSHE 1.6 userbank parameter.