newbee-mall · Issues· 28 open

Negative Cart Quantity Offsets the Order Total and Inflates the Stock Counter

[Sercuity]新蜂商城（newbee-mall）后台文件上传无后缀白名单，结合图片/HTML多型文件绕过BufferedImage校验，导致存储型XSS。

[Security]新蜂商城（newbee-mall）POST /admin/profile/name 缺乏 CSRF 防护，可跨站强制重命名管理员登录用户名，导致管理员被永久锁定

[Security]新蜂商城（newbee-mall） GET /admin/logout 接口缺少 CSRF 防护，可被诱导触发强制登出。

[Security] Unauthenticated Order Payment Status Manipulation via /paySuccess

[Security] Stored XSS in Rich Text Content on the Traditional Product Detail Page

[Security] Stored XSS in Product Detail Rich Text Content

Logical Vulnerability

Default admin credentials + weak MD5 password hashing enable full admin compromise and credential cracking

Experimenting with a.i.

File Upload Vulnerability

CSRF Vulnerability in Admin Carousel Management

CSRF Vulnerability in Personal Information Update

CSRF Vulnerability in Payment Processing

CSRF Vulnerability in Shopping Cart Item Deletion