CVE-2026-38808

MediumCVSS 5.3

Published: 27/05/2026(UTC)Updated: 19/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components.

Risk Assessment

This may lead to unauthorized access to and disclosure of data stored in the database.

Recommendation

Implement SQL query parameterization and input validation in the ProductMapper.xml and /OrderUtil.java components and update uzy-ssm-mall to a version containing the fix.

Other vulnerabilities in uzy-ssm-mall

CVE-2025-60833Medium
An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data.

Original NVD description (English source)

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components

Vulnerability data from NVD (NIST) · CISA KEV · EPSS