CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/08/2025 |
| CVE-2025-8527 | 高危8.8 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagger. The manipulation of the argument loginUrl leads to server | 04/08/2025 |
| CVE-2025-8526 | 严重9.8 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attac | 04/08/2025 |
| CVE-2025-8525 | 中危5.3 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public an | 04/08/2025 |
| CVE-2025-45612 | 严重9.8 | Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. | 05/05/2025 |
| CVE-2025-28399 | 严重9.8 | An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. | 15/04/2025 |
| CVE-2024-24112 | 严重9.8 | xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter. | 06/02/2024 |
| CVE-2021-43432 | 中危6.1 | A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp. | 07/04/2022 |