« Volver al listado

CVE-2026-11480

Estado: AplazadaBaja (2.1)—

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Beikeshop — BeikeshopAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-11480",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11480",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-08T13:00:45.863398Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:chengdu_everbrite_network_technology:beikeshop:*:*:*:*:*:*:*:*"
          ],
          "vendor": "Chengdu Everbrite Network Technology",
          "modules": [
            "Admin Design Builder Endpoint"
          ],
          "product": "BeikeShop",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0.0"
            },
            {
              "status": "affected",
              "version": "1.6.0.1"
            },
            {
              "status": "affected",
              "version": "1.6.0.2"
            },
            {
              "status": "affected",
              "version": "1.6.0.3"
            },
            {
              "status": "affected",
              "version": "1.6.0.4"
            },
            {
              "status": "affected",
              "version": "1.6.0.5"
            },
            {
              "status": "affected",
              "version": "1.6.0.6"
            },
            {
              "status": "affected",
              "version": "1.6.0.7"
            },
            {
              "status": "affected",
              "version": "1.6.0.8"
            },
            {
              "status": "affected",
              "version": "1.6.0.9"
            },
            {
              "status": "affected",
              "version": "1.6.0.10"
            },
            {
              "status": "affected",
              "version": "1.6.0.11"
            },
            {
              "status": "affected",
              "version": "1.6.0.12"
            },
            {
              "status": "affected",
              "version": "1.6.0.13"
            },
            {
              "status": "affected",
              "version": "1.6.0.14"
            },
            {
              "status": "affected",
              "version": "1.6.0.15"
            },
            {
              "status": "affected",
              "version": "1.6.0.16"
            },
            {
              "status": "affected",
              "version": "1.6.0.17"
            },
            {
              "status": "affected",
              "version": "1.6.0.18"
            },
            {
              "status": "affected",
              "version": "1.6.0.19"
            },
            {
              "status": "affected",
              "version": "1.6.0.20"
            },
            {
              "status": "affected",
              "version": "1.6.0.21"
            },
            {
              "status": "affected",
              "version": "1.6.0.22"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-08T03:16:20.363",
  "references": [
    {
      "url": "https://anonymous.4open.science/r/beikeshop-4B75/second-order-sqli-report.md",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-11480",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/833973",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/369100",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/369100/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Chengdu Everbrite Network Technology BeikeShop hasta 1.6.0.22. Afectada es una función desconocida del archivo beike/Admin/Routes/admin.php del componente Admin Design Builder Endpoint. Realizar una manipulación del argumento settings.value resulta en inyección SQL. Es posible iniciar el ataque remotamente. El exploit ha sido hecho público y podría ser usado. El parche es nombrado 2fa9805411088069fcc3b0c15b2f1f33d6e09958. Para corregir este problema, se recomienda desplegar un parche."
    }
  ],
  "lastModified": "2026-07-23T07:10:00.113",
  "sourceIdentifier": "cna@vuldb.com"
}