CVE-2026-8773
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
linlinjava litemall up to 1.8.0 contains a vulnerability in the backup/load function of DbUtil.java in the Database Setting Handler component. Manipulation of the db/password arguments leads to argument injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the vendor did not respond.
Risk Assessment
A remote attacker can exploit argument injection to perform unauthorized operations on the database or system. Public availability of the exploit increases the risk.
Recommendation
Restrict access to the backup/load function and administrative interface to trusted networks. Consider applying patches or mitigations given the vendor's lack of response.
Other vulnerabilities in litemall
See all- CVE-2026-105237Low
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the Login Endpoint component. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed remotely, though it is highly complex and difficult to exploit. The exploit is now public and may be used; the project has not responded to the issue report.
- CVE-2026-90570Low
A vulnerability was found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminGoodsService.validate of litemall-vue/src/views/items/detail/index.vue of the Product Detail component. Manipulation of the detail argument leads to cross site scripting and the attack may be launched remotely. The project was informed early but has not responded yet.
- CVE-2026-90569Low
A flaw was found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminTopicController.validate of litemall-vue/src/views/items/topic/index.vue of the Admin Topic Handler component. Manipulation causes cross site scripting and the attack may be initiated remotely. The project was informed early but has not responded yet.
- CVE-2026-8772Medium
A weakness was identified in linlinjava litemall up to 1.8.0 in an unknown function of the Admin Endpoint component. Input manipulation leads to SQL injection and the attack can be executed remotely. The exploit is publicly available and multiple endpoints are affected.
Original NVD description (English source)
A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vulnerability is the function backup/load of the file litemall-db/src/main/java/org/linlinjava/litemall/db/util/DbUtil.java of the component Database Setting Handler. The manipulation of the argument db/password leads to argument injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS