Firefly Mall
Approved changes feed: RSS · Atom
cpe:2.3:a:yiovo:firefly_mall:*:*:*:*:open_source:*:*:*part: a version: * update: *
| Vendor | Yiovo (c2a09607-c559-53a8-93cd-6524a8a9597f) |
|---|---|
| Product | Firefly Mall (bc9d5b05-50ba-5779-9287-5bd1ebd74588) |
| Edition | * |
| Language | * |
| Software edition | open_source |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-56162 |
vulnerable | 2026-06-08 07:33:15.538686 |
Details available
YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges.
Published: 2025-10-02T00:00:00.000Z
Updated: 2025-10-02T19:26:40.142Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-56161 |
vulnerable | 2026-06-08 07:33:15.538130 |
Details available
YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.
Published: 2025-10-02T00:00:00.000Z
Updated: 2025-10-02T18:13:36.507Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.