Threats affecting pkg:github/gongfuxiang/shopxo

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-12204 is an authorization bypass vulnerability in ShopXO versions 6.7.0 and 6.7.1. It affects several functions within the Scheduled Task Endpoint component, specifically in the app/api/controller/Crontab.php file. The vulnerability allows remote attackers to manipulate these functions to bypass authorization controls. The vulnerability has a medium severity rating with a CVSS score of 6.9. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available.

A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/system_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.