https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26219.htmlhttps://patchthecve.com/cve/CVE-2026-26219.htmlTue, 14 Jul 2026 16:16:59 +0000CRITICAL 9.1: newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidhttps://patchthecve.com/cve/CVE-2026-26218.htmlhttps://patchthecve.com/cve/CVE-2026-26218.htmlTue, 14 Jul 2026 16:16:58 +0000CRITICAL 9.8: newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may https://patchthecve.com/cve/CVE-2025-10423.htmlhttps://patchthecve.com/cve/CVE-2025-10423.htmlMon, 19 Oct 2026 17:10:00 +0000LOW 3.7: A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult.https://patchthecve.com/cve/CVE-2025-10422.htmlhttps://patchthecve.com/cve/CVE-2025-10422.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 4.3: A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderNo leads to improper authorization. Remote exploitation of thehttps://patchthecve.com/cve/CVE-2025-1114.htmlhttps://patchthecve.com/cve/CVE-2025-1114.htmlWed, 17 Jun 2026 08:38:24 +0000LOW 3.5: A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component Add Category Page. The manipulation of the argument categoryName leads to cross site scripting. It is possible to launch the attack remotely.https://patchthecve.com/cve/CVE-2024-48178.htmlhttps://patchthecve.com/cve/CVE-2024-48178.htmlWed, 17 Jun 2026 07:58:15 +0000HIGH 8.1: newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.