Skip to content
OpenAdvisories

Vendor

CoreUnion

3 known vulnerabilities.

Products

CoreShop 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-119656

    CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList

    CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's fie…

    CoreUnion CoreShop
  • High 7.5
    CVE-2026-119655

    CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

    CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boole…

    CoreUnion CoreShop