EUVD-2026-77052
GHSA-f265-5853-cc9h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS with no privileges required, but user interaction mandatory; scope changes to victim browser (S:C) with low C and I impact per standard reflected/stored XSS convention.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Reflected or stored cross-site scripting in the Order Printing component of Exrick xmall allows remote attackers to inject malicious scripts into victim browsers via the order-print.jsp template. The affected file is xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, which fails to sanitize user-controlled input before rendering it in HTML context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker can submit an order to the xmall storefront (i.e., the store is publicly accessible or the attacker has a customer account); (2) the injected payload must be stored in an order field that is later rendered unescaped in order-print.jsp; (3) a user with access to the manager web application (typically a store administrator) must open the print view for the crafted order. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 (Medium), reflecting network reachability, low complexity, no privileges required to inject the payload, but requiring user interaction (UI:P) and resulting only in integrity impact (VI:L) on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed commit has been identified at time of analysis - the vendor had not responded to the GitHub issue report (https://github.com/Exrick/xmall/issues/104) as of disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of
Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. Ra
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. Rated critical severity (
Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users'
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data.
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in p
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today