Gguchengwuyue

Products

Exploited and recent CVEs

• CVE-2026-111703 Medium 6.3 yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints 0.2%
• CVE-2026-110120 Medium 5.4 yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController 0.2%
• CVE-2026-110119 High 7.1 yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController 0.3%
• CVE-2026-109173 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint 0.2%
• CVE-2026-109172 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint 0.2%
• CVE-2026-109171 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check 0.2%
• CVE-2026-92463 Medium 6.5 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing 0.5%
• CVE-2026-92462 Medium 6.5 yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep 0.4%
• CVE-2026-92461 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint 0.4%
• CVE-2026-92460 Medium 6.5 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing 0.5%
• CVE-2026-92459 Medium 6.5 yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint 0.4%
• CVE-2026-92458 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale 0.4%
• CVE-2026-92457 Medium 6.5 yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice 0.4%
• CVE-2026-92456 High 7.1 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints 0.5%
• CVE-2026-92455 Medium 4.3 yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints 0.4%
• CVE-2026-2146 Medium 6.3 guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload 0.3%
• CVE-2025-15496 Medium 6.3 guchengwuyue yshopmall jobs getPage sql injection 0.4%