linlinjava vulnerabilities

Products

• litemall 17

Latest linlinjava CVEs

Newest publication first

1. CVE-2026-105237 linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

   Published 2026-10-05

   Medium·CVSS 6.3

   A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction...

2. CVE-2026-90570 linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting

   Published 2026-09-13

   Medium·CVSS 4.8

   A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail lead...

3. CVE-2026-90569 linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting

   Published 2026-09-13

   Medium·CVSS 4.8

   A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemall-vue/src/views/items/topic/index.vue of the component Admin Topic Handler. This manipulation causes cross site scripting...

4. CVE-2026-8773 linlinjava litemall Database Setting DbUtil.java load argument injection

   Published 2026-05-18

   Medium·CVSS 5.1

   A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation...

5. CVE-2026-8772 linlinjava litemall Admin Endpoint sql injection

   Published 2026-05-17

   Medium·CVSS 5.1

   A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could...

6. CVE-2026-8771 linlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection

   Published 2026-05-17

   Medium·CVSS 6.9

   A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java of the component Front-end WeChat API. Performing a manipulation results in sql i...

7. CVE-2025-10291 linlinjava litemall cancel WxAftersaleController improper authorization

   Published 2025-09-12

   Medium·CVSS 5.3

   A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack can be executed remotely. The exploit has...

8. CVE-2025-8991 linlinjava litemall Business Logic express logic error

   Published 2025-08-15

   Medium·CVSS 5.3

   A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express of the component Business Logic Handler. The manipulation of the argument litemall_express_freight_min leads to business...

9. CVE-2025-8974 linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials

   Published 2025-08-14

   Medium·CVSS 6.3

   A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argume...

10. CVE-2025-8965 linlinjava litemall Endpoint AdminStorageController.java create unrestricted upload

    Published 2025-08-14

    Medium·CVSS 5.3

    A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument...

11. CVE-2025-8764 linlinjava litemall upload unrestricted upload

    Published 2025-08-09

    Medium·CVSS 5.3

    A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit...

12. CVE-2025-8753 linlinjava litemall File delete path traversal

    Published 2025-08-09

    Medium·CVSS 5.3

    A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Affected by this issue is the function delete of the file /admin/storage/delete of the component File Handler. The manipulation of the argument key leads to path traversal. The a...

13. CVE-2025-6702 linlinjava litemall post improper authorization

    Published 2025-06-26

    Medium·CVSS 5.3

    A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The manipulation of the argument adminComment leads to improper authorization. It is possible to launch the attack remotely....

14. CVE-2024-46382 A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminOrderController.java.

    Published 2024-09-19

    High·CVSS 7.5

    A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminOrderController.java.

15. CVE-2024-6452 linlinjava litemall AdminGoodscontroller.java sql injection

    Published 2024-07-02

    Medium·CVSS 5.3

    A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection. The attack can be l...

16. CVE-2024-24323 SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrderc...

    Published 2024-02-27

    High·CVSS 7.2

    SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrdercontroller.java component.

17. CVE-2018-18434 An issue was discovered in litemall 0.9.0. Arbitrary file download is possible via ../ directory traversal in linlinjava/litemall/wx/web/WxStorageController.java in the litemall-wx-api component.

    Published 2018-10-17

    High·CVSS 7.5

    An issue was discovered in litemall 0.9.0. Arbitrary file download is possible via ../ directory traversal in linlinjava/litemall/wx/web/WxStorageController.java in the litemall-wx-api component.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.