ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-28094 · ADVISORY
• gongfuxiang/shopxo · PACKAGE
• yuque.com/morysummer/vx41bz/echzollcdlmllgqo · WEB

shopxo/shopxo 的其他漏洞

• CVE-2025-28093中危 6.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
• CVE-2025-28092中危 6.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
• CVE-2024-6524高危 8.8A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionalit…
• CVE-2021-41938高危 7.2An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three lo…
• CVE-2022-28056严重 9.8ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php…