CVE-2025-8991

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was identified in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file /admin/config/express of the component Business Logic Handler. The manipulation of the argument litemall_express_freight_min leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-840

Affected software

Vendor	Product	Versions
linlinjava	litemall	1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8.0

References

https://github.com/linlinjava/litemall/issues/566Exploit, Issue Tracking, Vendor Advisory
https://github.com/linlinjava/litemall/issues/566#issue-3267858791Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.319987Permissions Required, VDB Entry
https://vuldb.com/?id.319987Third Party Advisory, VDB Entry
https://vuldb.com/?submit.628764Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-89926.5A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to c CVE-2025-89939.8A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/expe CVE-2025-89946.5The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is v CVE-2025-89959.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue CVE-2025-89964.3Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder CVE-2025-89975.7An Information Exposure vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely explo CVE-2025-89983.1It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. Thi CVE-2025-89995.3The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules CVE-2025-90007.0A vulnerability was detected in Mechrevo Control Center GX V2 5.56.51.48. Impacted is an unknown function of the component reg File Handler.CVE-2025-90017.5A vulnerability was determined in LemonOS up to nightly-2024-07-12 on LemonOS. Affected by this issue is the function HTTPGet of the file /A CVE-2025-90029.8A vulnerability was identified in Surbowl dormitory-management-php 1.0. This affects an unknown part of the file login.php. The manipulation CVE-2025-90035.4A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component D