CVE-2026-75308
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In yshopmall version 3.3 and earlier, there is a Cross Site Scripting (XSS) vulnerability. The file upload endpoint /api/upload lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
Risk Assessment
The vulnerability allows attackers to upload malicious files that can be executed on the server or in the victim's browser, potentially leading to session hijacking, data theft, or server compromise.
Recommendation
It is recommended to upgrade yshopmall to a version newer than 3.3 if available, and implement server-side file type validation.
Other vulnerabilities in yshopmall
See all- CVE-2026-110120Medium
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
- CVE-2026-110119High
Yshopmall through 2.0.0 contains an insecure direct object reference (IDOR) vulnerability in the member address API. Authenticated members can read, overwrite, and delete other members' shipping addresses by enumerating sequential address IDs via /address/detail/{id}, /address/del, and /address/edit.
Original NVD description (English source)
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS