CVE-2025-15496

guchengwuyue yshopmall jobs getPage sql injection

CVSS 5.3 MEDIUMEPSS 0.3%CWE-74 CWE-89

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

09 ene 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

guchengwuyue · yshopmall

Referencias

https://github.com/guchengwuyue/yshopmall/https://github.com/guchengwuyue/yshopmall/issues/39 https://github.com/guchengwuyue/yshopmall/issues/39#issue-3769727898 https://vuldb.com/?ctiid.340274 https://vuldb.com/?id.340274 https://vuldb.com/?submit.726464