« Back to list

CVE-2026-11480

Status: DeferredLow (2.1)—

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Beikeshop — BeikeshopAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-11480",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11480",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-08T13:00:45.863398Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:chengdu_everbrite_network_technology:beikeshop:*:*:*:*:*:*:*:*"
          ],
          "vendor": "Chengdu Everbrite Network Technology",
          "modules": [
            "Admin Design Builder Endpoint"
          ],
          "product": "BeikeShop",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0.0"
            },
            {
              "status": "affected",
              "version": "1.6.0.1"
            },
            {
              "status": "affected",
              "version": "1.6.0.2"
            },
            {
              "status": "affected",
              "version": "1.6.0.3"
            },
            {
              "status": "affected",
              "version": "1.6.0.4"
            },
            {
              "status": "affected",
              "version": "1.6.0.5"
            },
            {
              "status": "affected",
              "version": "1.6.0.6"
            },
            {
              "status": "affected",
              "version": "1.6.0.7"
            },
            {
              "status": "affected",
              "version": "1.6.0.8"
            },
            {
              "status": "affected",
              "version": "1.6.0.9"
            },
            {
              "status": "affected",
              "version": "1.6.0.10"
            },
            {
              "status": "affected",
              "version": "1.6.0.11"
            },
            {
              "status": "affected",
              "version": "1.6.0.12"
            },
            {
              "status": "affected",
              "version": "1.6.0.13"
            },
            {
              "status": "affected",
              "version": "1.6.0.14"
            },
            {
              "status": "affected",
              "version": "1.6.0.15"
            },
            {
              "status": "affected",
              "version": "1.6.0.16"
            },
            {
              "status": "affected",
              "version": "1.6.0.17"
            },
            {
              "status": "affected",
              "version": "1.6.0.18"
            },
            {
              "status": "affected",
              "version": "1.6.0.19"
            },
            {
              "status": "affected",
              "version": "1.6.0.20"
            },
            {
              "status": "affected",
              "version": "1.6.0.21"
            },
            {
              "status": "affected",
              "version": "1.6.0.22"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-08T03:16:20.363",
  "references": [
    {
      "url": "https://anonymous.4open.science/r/beikeshop-4B75/second-order-sqli-report.md",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-11480",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/833973",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/369100",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/369100/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en Chengdu Everbrite Network Technology BeikeShop hasta 1.6.0.22. Afectada es una función desconocida del archivo beike/Admin/Routes/admin.php del componente Admin Design Builder Endpoint. Realizar una manipulación del argumento settings.value resulta en inyección SQL. Es posible iniciar el ataque remotamente. El exploit ha sido hecho público y podría ser usado. El parche es nombrado 2fa9805411088069fcc3b0c15b2f1f33d6e09958. Para corregir este problema, se recomienda desplegar un parche."
    }
  ],
  "lastModified": "2026-07-23T07:10:00.113",
  "sourceIdentifier": "cna@vuldb.com"
}