https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2146.htmlhttps://patchthecve.com/cve/CVE-2026-2146.htmlWed, 17 Jun 2026 10:30:24 +0000MEDIUM 6.3: A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to bhttps://patchthecve.com/cve/CVE-2025-15496.htmlhttps://patchthecve.com/cve/CVE-2025-15496.htmlWed, 17 Jun 2026 08:37:53 +0000MEDIUM 6.3: A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project wahttps://patchthecve.com/cve/CVE-2025-25426.htmlhttps://patchthecve.com/cve/CVE-2025-25426.htmlWed, 17 Jun 2026 09:00:45 +0000HIGH 7.2: yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.https://patchthecve.com/cve/CVE-2024-50648.htmlhttps://patchthecve.com/cve/CVE-2024-50648.htmlWed, 17 Jun 2026 08:04:52 +0000CRITICAL 9.8: yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.