Guchengwuyue vulnerabilities
We track 4 vulnerabilities in Guchengwuyue products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest Guchengwuyue vulnerabilities
- 7.1 High severity
yshopmall: Authorization Bypass Through User-Controlled Key
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /
- 7.1 High severity
yshop-crm: Missing Authorization
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy.
- 8.8 High severity
yshopmall: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestri
- 9.8 Critical severity
yshopmall: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly discl