EUVD-2026-75210
GHSA-wvvf-rj6j-5fcw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
AnalysisAI
yshopmall through version 3.3 exposes an unauthenticated file upload endpoint (/api/upload) that performs no file type validation, allowing attackers to place arbitrary HTML, JSP or other executable content on the server. Because uploaded files are reachable from the application's origin, a crafted HTML file can execute script in a victim's browser session (reflected/stored XSS, CVSS 6.1, CWE-79), and a JSP upload could escalate to server-side code execution if the upload directory is served by a JSP-capable container. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today