Newbee-mall Project Newbee-mall 1.0.0
Approved changes feed: RSS · Atom
cpe:2.3:a:newbee-mall_project:newbee-mall:1.0.0:*:*:*:*:*:*:*part: a version: 1.0.0 update: *
| Vendor | Newbee Mall Project (67f4d534-ed5d-5893-a2f9-f53b46974944) |
|---|---|
| Product | Newbee Mall (663c1ee1-4fb6-5fc5-b719-0a69c9fc64ad) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/newbee-ltd/newbee-mall |
purl2cpe | 2026-06-01 10:13:48.147680 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26219 |
vulnerable | 2026-06-08 07:53:21.423583 |
newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking
CRITICAL (9.1)
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.
Published: 2026-02-12T18:39:50.267Z
Updated: 2026-07-14T15:54:03.165Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26218 |
vulnerable | 2026-06-08 07:53:21.422837 |
newbee-mall Default Seeded Administrator Credentials Allow Account Takeover
CRITICAL (9.8)
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
Published: 2026-02-12T18:38:40.357Z
Updated: 2026-07-14T15:54:02.485Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-48178 |
vulnerable | 2026-06-08 06:48:13.658632 |
Details available
newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
Published: 2024-10-28T00:00:00.000Z
Updated: 2024-10-30T17:38:26.747Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-27476 |
vulnerable | 2026-06-08 05:41:55.301373 |
Details available
A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.
Published: 2022-04-10T21:01:37.000Z
Updated: 2024-08-03T05:25:32.686Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.