CVE-2026-26218criticalCWE-798

CVE-2026-26218: fallo crítico en newbee-ltd newbee-mall

newbee-mall Default Seeded Administrator Credentials Allow Account Takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear newbee-mall

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.4%
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
newbee-ltd · newbee-mall
CVEs relacionadas — newbee-ltd newbee-mall

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-94045MEDIUMnewbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scriptingEPSS 0.4%CVE-2026-2658MEDIUMnewbee-ltd newbee-mall Multiple Endpoints cross-site request forgeryEPSS 0.3%CVE-2026-105573MEDIUMnewbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic errorEPSS 0.2%CVE-2026-26219CRITICALnewbee-mall Unsalted MD5 Password Hashing Enables Offline Credential CrackingEPSS 0.2%