CVE-2025-15496: medium-severity vulnerability in guchengwuyue yshopmall
guchengwuyue yshopmall jobs getPage sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
guchengwuyue · yshopmallRelated CVEs — guchengwuyue yshopmall
In the same product, most dangerous first.
CVE-2026-2146MEDIUMguchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted uploadEPSS 0.3%CVE-2026-110119HIGHyshopmall through 2.0.0 IDOR via Member Address API in UserAddressControllerEPSS 0.3%CVE-2026-110120MEDIUMyshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesControllerEPSS 0.2%