Yshopmall vulnerabilities
3 known vulnerabilities in Yshopmall from Guchengwuyue. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
yshopmall: Authorization Bypass Through User-Controlled Key
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /
- 8.8 High severity
yshopmall: Unrestricted Upload of File with Dangerous Type
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestri
- 9.8 Critical severity
yshopmall: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly discl