CVE-2026-119655

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1196567.5CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via t CVE-2026-1196575.0FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage othe CVE-2026-1196584.3PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh seco CVE-2026-1196595.4Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because CVE-2026-119665.3The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of CVE-2026-1196609.8MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using CVE-2026-1196614.2ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permiss CVE-2026-1196628.8Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as admini CVE-2026-1196634.3Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create CVE-2026-1196644.3Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handl CVE-2026-1196656.3WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows au CVE-2026-119678.5MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located