CVE-2026-105237
LowCVSS 3.7Summary
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the Login Endpoint component. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed remotely, though it is highly complex and difficult to exploit. The exploit is now public and may be used; the project has not responded to the issue report.
Risk Assessment
Lack of login attempt restriction allows an attacker to perform brute-force or credential stuffing attacks, potentially leading to administrative account takeover.
Recommendation
Apply the vendor fix or manually implement login attempt restrictions (rate limiting, account lockout) on the admin login endpoint.
Other vulnerabilities in litemall
See all- CVE-2026-90570Low
A vulnerability was found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminGoodsService.validate of litemall-vue/src/views/items/detail/index.vue of the Product Detail component. Manipulation of the detail argument leads to cross site scripting and the attack may be launched remotely. The project was informed early but has not responded yet.
- CVE-2026-90569Low
A flaw was found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminTopicController.validate of litemall-vue/src/views/items/topic/index.vue of the Admin Topic Handler component. Manipulation causes cross site scripting and the attack may be initiated remotely. The project was informed early but has not responded yet.
Original NVD description (English source)
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. A high complexity level is associated with this attack. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS