EUVD-2026-77047
GHSA-3xv5-8pf6-5753
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin privileges required to inject payload; scope change to victim browser sessions; no availability impact from stored XSS.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site scripting. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored cross-site scripting in linlinjava litemall versions 1.4.0 through 1.8.0 allows a high-privileged attacker to inject malicious scripts via the detail argument processed by AdminGoodsService.validate in the Product Detail admin component. Exploitation requires admin-level credentials to write the payload and passive interaction from a second user viewing the poisoned product detail page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds an active admin-level session in the litemall application, as indicated by PR:H in the CVSS 4.0 vector - unauthenticated or low-privilege users cannot reach the product-detail editing interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P) yields a 4.8 Medium score, accurately capturing the meaningful prerequisites: an attacker must already hold active admin-level credentials and a second privileged user must view the poisoned page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to responsible disclosure issue IK5SVR (https://gitee.com/linlinjava/litemall/issues/IK5SVR). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in linlinjava litemall 1.8.0 allows unauthenticated remote attackers to extract sensitive data from the ba
SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via
A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), t
An issue was discovered in litemall 0.9.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
A vulnerability was determined in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 6.3), this vulnerability
CVE-2025-6702 is a security vulnerability (CVSS 4.3). Risk factors: public PoC available.
A vulnerability was identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability
A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Rated medium sever
A vulnerability has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.
Stored cross-site scripting in linlinjava litemall's admin topic management panel allows a high-privileged attacker to i
A weakness has been identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today