What is the CVSS score of CVE-2026-38808?

CVE-2026-38808 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

uzy-ssm-mall CVE-2026-38808

MEDIUM

SQL Injection (CWE-89)

2026-05-27 cve@mitre.org

Java SQLi

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 16:22 vuln.today

CVSS changed

May 28, 2026 - 16:22 NVD

5.3 (None) 5.3 (MEDIUM)

CVE Published

May 27, 2026 - 18:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components

AnalysisAI

SQL injection in uzy-ssm-mall v1.1.0 exposes sensitive database information to unauthenticated remote attackers via unsanitized input passed through the ProductMapper.xml MyBatis mapper and OrderUtil.java components. The vulnerability requires no authentication or user interaction, making it trivially automatable according to the SSVC framework. No public exploit identified at time of analysis, and EPSS sits at 0.04% (12th percentile), indicating low current exploitation pressure despite the permissive attack surface.

Technical ContextAI

uzy-ssm-mall is a Java e-commerce application built on the SSM stack - Spring, SpringMVC, and MyBatis. ProductMapper.xml is a MyBatis SQL mapper file, and OrderUtil.java is a utility class handling order logic. CWE-89 (SQL Injection) indicates that user-controlled input is concatenated directly into SQL queries - a classic MyBatis misuse pattern where the ${} interpolation operator is used instead of the safe #{} parameterized binding. This bypasses MyBatis's built-in prepared statement protections. The affected components suggest both product catalog and order management endpoints are injectable surfaces. No CPE string was provided, but the affected version is confirmed as v1.1.0.

Affected ProductsAI

uzy-ssm-mall version 1.1.0 is confirmed affected. The vulnerability is present in the ProductMapper.xml MyBatis mapper file and the OrderUtil.java component. No CPE string was provided in the source intelligence. No additional version ranges are confirmed - earlier or later versions are unknown status. The sole reference is a GitHub issue at https://github.com/cagexunxi/CVE/issues/3, which is the original researcher disclosure.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix should be to replace MyBatis ${} variable interpolation with #{} parameterized bindings in ProductMapper.xml and any raw SQL construction in OrderUtil.java, which forces prepared statement usage and eliminates injection. As a compensating control, deploy a web application firewall (WAF) rule targeting SQL metacharacters on the product and order API endpoints - note this adds latency and may produce false positives on legitimate search queries containing SQL-like strings. Additionally, enforce least-privilege database accounts for the application so that exploitation yields only the permissions granted to the app DB user, limiting data disclosure scope. Review the full mapper layer for additional ${} usage beyond the two named components. Monitor the GitHub issue at https://github.com/cagexunxi/CVE/issues/3 for patch availability.