Newbee Mall Plus
Monthly
Unrestricted file upload in newbee-mall-plus 2.0.0 permits authenticated high-privilege users to submit arbitrary files through the Product Information Edit Page, bypassing server-side file type validation in UploadController.java. The affected CPE is cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*, and a public proof-of-concept has been disclosed via GitHub. No patch is available at time of analysis, as the vendor did not respond to responsible disclosure; however, EPSS at 0.05% (17th percentile) and the PR:H CVSS requirement together indicate low observed exploitation probability despite POC existence.
Unrestricted file upload in newbee-mall-plus 2.0.0 permits authenticated high-privilege users to submit arbitrary files through the Product Information Edit Page, bypassing server-side file type validation in UploadController.java. The affected CPE is cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*, and a public proof-of-concept has been disclosed via GitHub. No patch is available at time of analysis, as the vendor did not respond to responsible disclosure; however, EPSS at 0.05% (17th percentile) and the PR:H CVSS requirement together indicate low observed exploitation probability despite POC existence.