CVE-2026-2658mediumCWE-352CWE-862

CVE-2026-2658: fallo de gravedad media en newbee-ltd newbee-mall

newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear newbee-mall

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
newbee-ltd · newbee-mall
CVEs relacionadas — newbee-ltd newbee-mall

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-26218CRITICALnewbee-mall Default Seeded Administrator Credentials Allow Account TakeoverEPSS 0.4%CVE-2026-94045MEDIUMnewbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scriptingEPSS 0.4%CVE-2026-105573MEDIUMnewbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic errorEPSS 0.2%CVE-2026-26219CRITICALnewbee-mall Unsalted MD5 Password Hashing Enables Offline Credential CrackingEPSS 0.2%