Threat Intelligence Database

CVE-2026-105573 is a medium severity vulnerability in newbee-ltd newbee-mall versions 2.7.0 through 2.7.5. It involves business logic errors triggered by manipulation of the goodsCount argument in the Shopping Cart Quantity Handler component. The vulnerability can be exploited remotely without user interaction. Although the issue was reported early, the vendor has not yet responded or issued a fix. Public exploit code exists, but no known active exploitation in the wild has been reported.

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.