CVE-2026-26218
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
Risk Assessment
The risk for the organization is the potential for complete takeover of the application by an unauthenticated attacker, leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
It is recommended to immediately change the default password for all administrator accounts in newbee-mall and remove or modify the database initialization script to avoid pre-seeded accounts with default passwords.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26219Critical
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
- CVE-2026-105573Medium
A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-94045Low
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
Original NVD description (English source)
newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS