Linlinjava
Monthly
Stored cross-site scripting in linlinjava litemall versions 1.4.0 through 1.8.0 allows a high-privileged attacker to inject malicious scripts via the `detail` argument processed by `AdminGoodsService.validate` in the Product Detail admin component. Exploitation requires admin-level credentials to write the payload and passive interaction from a second user viewing the poisoned product detail page. No public exploit has been identified at time of analysis, and the project maintainer has not responded to the responsible disclosure issue filed on Gitee.
Stored cross-site scripting in linlinjava litemall's admin topic management panel allows a high-privileged attacker to inject malicious scripts via the AdminTopicController.validate function, which are then executed in the browsers of other users who view the affected topic page. Versions 1.5.0 through 1.8.0 are affected. No vendor patch is available; the project has not responded to the responsible disclosure filed in Gitee issue IK5SUU. No public exploit code or CISA KEV listing has been identified at time of analysis.
A weakness has been identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2025-6702 is a security vulnerability (CVSS 4.3). Risk factors: public PoC available.
SQL injection in linlinjava litemall 1.8.0 allows unauthenticated remote attackers to extract sensitive data from the backend database by injecting malicious payloads into the goodsId, goodsSn, and name parameters handled by AdminOrderController.java. Publicly available exploit code exists, though EPSS rates exploitation probability low at 0.12% (30th percentile) and the issue is not listed in CISA KEV.
A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in litemall 0.9.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Stored cross-site scripting in linlinjava litemall versions 1.4.0 through 1.8.0 allows a high-privileged attacker to inject malicious scripts via the `detail` argument processed by `AdminGoodsService.validate` in the Product Detail admin component. Exploitation requires admin-level credentials to write the payload and passive interaction from a second user viewing the poisoned product detail page. No public exploit has been identified at time of analysis, and the project maintainer has not responded to the responsible disclosure issue filed on Gitee.
Stored cross-site scripting in linlinjava litemall's admin topic management panel allows a high-privileged attacker to inject malicious scripts via the AdminTopicController.validate function, which are then executed in the browsers of other users who view the affected topic page. Versions 1.5.0 through 1.8.0 are affected. No vendor patch is available; the project has not responded to the responsible disclosure filed in Gitee issue IK5SUU. No public exploit code or CISA KEV listing has been identified at time of analysis.
A weakness has been identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was identified in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2025-6702 is a security vulnerability (CVSS 4.3). Risk factors: public PoC available.
SQL injection in linlinjava litemall 1.8.0 allows unauthenticated remote attackers to extract sensitive data from the backend database by injecting malicious payloads into the goodsId, goodsSn, and name parameters handled by AdminOrderController.java. Publicly available exploit code exists, though EPSS rates exploitation probability low at 0.12% (30th percentile) and the issue is not listed in CISA KEV.
A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in litemall 0.9.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.