Newbee-mall Project
Newbee-mall Project Newbee-mall: vulnerabilidades y CVE
Newbee-mall Project Newbee-mall tiene 14 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 5 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses2
Críticas5
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-26219 | Crítica (9.3) | 0.29% | — | 12 feb 2026 | newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password… |
| CVE-2026-26218 | Crítica (9.3) | 0.57% | — | 12 feb 2026 | newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using… |
| CVE-2025-10423 | Baja (2.9) | 0.45% | — | 15 sept 2025 | A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity… |
| CVE-2025-10422 | Baja (2.1) | 0.30% | — | 15 sept 2025 | A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of… |
| CVE-2025-4259 | Media (5.3) | 0.53% | — | 5 may 2025 | A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation… |
| CVE-2025-1114 | Media (5.1) | 0.34% | — | 7 feb 2025 | A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument… |
| CVE-2024-48178 | Alta (8.1) | 0.34% | — | 28 oct 2024 | newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. |
| CVE-2023-30216 | Media (5.4) | 0.33% | — | 4 may 2023 | Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information. |
| CVE-2022-27477 | Crítica (9.8) | 1.1% | — | 10 abr 2022 | Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. |
| CVE-2022-27476 | Media (6.1) | 0.56% | — | 10 abr 2022 | A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter. |
| CVE-2020-23449 | Alta (7.5) | 0.87% | — | 26 ene 2021 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID. |
| CVE-2020-23448 | Crítica (9.8) | 1.6% | — | 26 ene 2021 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of the system's background /admin is in code… |
| CVE-2020-23447 | Media (6.1) | 0.66% | — | 26 ene 2021 | newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write xss payload in their address information when buying goods, which is triggered when viewing the "View Recipient… |
| CVE-2019-19113 | Crítica (9.8) | 1.8% | — | 18 nov 2019 | main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.