CVE-2025-10423
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In newbee-mall 1.0, the mallKaptcha function in /common/mall/kaptcha produces a guessable captcha. The attack can be executed remotely, is of high complexity and difficult exploitability, and the exploit is publicly available.
Risk Assessment
A guessable captcha facilitates attack automation, such as mass registrations or login attempts. High complexity limits the risk, but the exploit is public.
Recommendation
Replace the captcha mechanism with a guess-resistant solution or apply the fix. Monitor for unusual request patterns to the captcha endpoint.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26219Critical
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
- CVE-2026-26218Critical
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
- CVE-2026-105573Medium
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-94045Low
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
- CVE-2025-10422Medium
In newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7, the paySuccess function in /paySuccess (Order Status Handler component) is vulnerable to manipulation of the orderNo argument leading to improper authorization. Remote exploitation is possible and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS