Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how xmall compares to other vendors in security performance

View Risk Score →

xmall xmallIncorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET r…

Risk 61
Severity
9.8
EPSS
0.07%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.

First published (updated )
CVE-2025-45612

xmall xmallIncorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily …

Risk 54
Severity
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

First published (updated )
CVE-2023-36331

xmall xmallXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.

First published (updated )
CVE-2025-65540

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203