CVE-2026-94045
LowCVSS 3.5Summary
A security flaw has been discovered in newbee-ltd newbee-mall up to version 1.0.0. An unknown function in controller/common/UploadController.java, part of the Goods Save Endpoint component, is impacted. Manipulating the goodsName argument results in cross-site scripting, and the attack can be initiated remotely. The exploit has been publicly released and may be used for attacks.
Risk Assessment
The vulnerability allows remote XSS attacks, which can lead to session theft, admin account takeover, or arbitrary actions in the victim's browser. Given the publicly available exploit, the risk is high.
Recommendation
Immediately update newbee-mall to the latest version if a patch is available, or implement input validation and filtering (especially for the goodsName parameter) and deploy XSS protection mechanisms. Until a fix is released, restrict access to the upload functionality and monitor for unusual requests.
Other vulnerabilities in newbee-mall
See all- CVE-2026-26219Critical
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
- CVE-2026-26218Critical
The vulnerability in newbee-mall is due to pre-seeded administrator accounts in the database initialization script with a predictable default password. If deployments use this script and do not change the default credentials, unauthenticated attackers can log in as an administrator and gain full administrative control of the application.
Original NVD description (English source)
A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG|<img onerror> payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.