Vulnerabilidades do Exrick Xmall

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Exrick Xmall: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:exrick:xmall

CVE-2023-36331 Alta · 8.2 CWE-639 12/01/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Exrick Xmall

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

CVE-2025-65540 Média · 6.1 CWE-79 29/11/2025

Cross-site Scripting (XSS) em Exrick Xmall

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.