https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-60834.htmlhttps://patchthecve.com/cve/CVE-2025-60834.htmlWed, 17 Jun 2026 09:50:08 +0000MEDIUM 6.5: A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.https://patchthecve.com/cve/CVE-2025-60833.htmlhttps://patchthecve.com/cve/CVE-2025-60833.htmlWed, 17 Jun 2026 09:50:08 +0000MEDIUM 6.5: An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data.https://patchthecve.com/cve/CVE-2025-3561.htmlhttps://patchthecve.com/cve/CVE-2025-3561.htmlWed, 17 Jun 2026 09:20:11 +0000MEDIUM 4.3: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendhttps://patchthecve.com/cve/CVE-2025-3560.htmlhttps://patchthecve.com/cve/CVE-2025-3560.htmlWed, 17 Jun 2026 09:20:10 +0000LOW 3.5: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The manipulation of the argument product_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed thttps://patchthecve.com/cve/CVE-2025-3559.htmlhttps://patchthecve.com/cve/CVE-2025-3559.htmlWed, 17 Jun 2026 09:20:10 +0000MEDIUM 6.3: A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The explohttps://patchthecve.com/cve/CVE-2025-3558.htmlhttps://patchthecve.com/cve/CVE-2025-3558.htmlWed, 17 Jun 2026 09:20:10 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has be