Exrick vulnerabilities
We track 4 vulnerabilities in Exrick products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on January 12, 2026.
Latest Exrick vulnerabilities
- 8.2 High severity
Xmall: Authorization Bypass Through User-Controlled Key
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.
- 8.8 High severity
xboot: Server-Side Request Forgery
A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagge
- 9.8 Critical severity
xboot: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation
- 9.8 Critical severity
Xmall: Improper Privilege Management
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.