litemall EUVD-2026-30717

Q: What is the CVSS score of EUVD-2026-30717?

EUVD-2026-30717 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8773 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-18 cna@vuldb.com

GHSA-34wv-75jw-6v6p

Java Information Disclosure

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 00:28 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Argument injection in litemall Database Setting Handler allows authenticated administrators with high privileges to inject malicious arguments into database backup/load operations, potentially exposing sensitive database credentials or altering backup behavior. Publicly disclosed exploit code exists (CVSS:4.0 E:P), but vendor has not responded to disclosure. EPSS data not available; low CVSS base score (2.0) reflects high privilege requirement (PR:H) limiting widespread exploitation despite network attack vector.

Technical ContextAI

The vulnerability affects linlinjava litemall (a Java-based e-commerce platform) versions up to 1.8.0, specifically in the DbUtil.java component responsible for database backup and restore operations. The flaw is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component / Injection). The backup/load function in litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java fails to properly sanitize the db/password argument before passing it to downstream processes. This allows injection of arbitrary arguments that can alter the behavior of database operations or expose configuration data. The vulnerability manifests when processing database credentials during backup or restoration procedures, where user-controlled input is directly incorporated into command execution without adequate validation or escaping.

RemediationAI

No vendor-released patch identified at time of analysis - maintainer did not respond to vulnerability disclosure. Organizations running litemall 1.8.0 or earlier should implement compensating controls immediately. Primary mitigation: Restrict access to database backup/load functionality to only essential administrators, implement strict authentication and authorization controls, and enable comprehensive audit logging for all database operations (log source IP, timestamp, parameters used). Secondary control: If feasible, modify DbUtil.java to implement input validation and sanitization for the db/password argument using allowlists for special characters and parameterized queries instead of string concatenation. Code-level fix would require forking the repository or applying custom patches since no upstream fix exists. Monitor GitHub repository https://github.com/linlinjava/litemall for potential future patches. Operational workaround: Disable remote access to administrative database functions, requiring database operations to be performed only from localhost or through jump hosts with enhanced monitoring. Consider migrating to actively maintained e-commerce platforms with responsive security teams if litemall is mission-critical.