https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-10291.htmlhttps://patchthecve.com/cve/CVE-2025-10291.htmlWed, 17 Jun 2026 08:28:04 +0000MEDIUM 6.3: A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack can be executed remotely. The exploit has been made available https://patchthecve.com/cve/CVE-2025-8991.htmlhttps://patchthecve.com/cve/CVE-2025-8991.htmlWed, 17 Jun 2026 10:08:06 +0000MEDIUM 4.3: A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express of the component Business Logic Handler. The manipulation of the argument litemall_express_freight_min leads to business logic errors. The ahttps://patchthecve.com/cve/CVE-2025-8974.htmlhttps://patchthecve.com/cve/CVE-2025-8974.htmlWed, 17 Jun 2026 10:08:04 +0000LOW 3.7: A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the ihttps://patchthecve.com/cve/CVE-2025-8965.htmlhttps://patchthecve.com/cve/CVE-2025-8965.htmlWed, 17 Jun 2026 10:08:02 +0000MEDIUM 6.3: A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument File leads to unreshttps://patchthecve.com/cve/CVE-2025-8764.htmlhttps://patchthecve.com/cve/CVE-2025-8764.htmlWed, 17 Jun 2026 10:07:35 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed thttps://patchthecve.com/cve/CVE-2025-8753.htmlhttps://patchthecve.com/cve/CVE-2025-8753.htmlWed, 17 Jun 2026 10:07:33 +0000MEDIUM 5.4: A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Affected by this issue is the function delete of the file /admin/storage/delete of the component File Handler. The manipulation of the argument key leads to path traversal. The attack may be launchehttps://patchthecve.com/cve/CVE-2025-6702.htmlhttps://patchthecve.com/cve/CVE-2025-6702.htmlWed, 17 Jun 2026 10:02:24 +0000MEDIUM 4.3: A vulnerability, which was classified as problematic, was found in linlinjava litemall 1.8.0. Affected is an unknown function of the file /wx/comment/post. The manipulation of the argument adminComment leads to improper authorization. It is possible to launch the attack remotely. The exploit has beehttps://patchthecve.com/cve/CVE-2024-46382.htmlhttps://patchthecve.com/cve/CVE-2024-46382.htmlWed, 17 Jun 2026 07:55:20 +0000HIGH 7.5: A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminOrderController.java.https://patchthecve.com/cve/CVE-2024-6452.htmlhttps://patchthecve.com/cve/CVE-2024-6452.htmlWed, 17 Jun 2026 08:18:02 +0000MEDIUM 6.3: A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection. The attack can be launched remotely. Th