Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records. Join the discussion | CVE Database V5 | 10/13/2026, 18:30:55 UTC Added: 10/13/2026, 17:04:22 UTC |
0 CVE-2026-110119 is an authorization bypass vulnerability in guchengwuyue's yshopmall product up to version 2.0.0. It allows authenticated users to access and manipulate other members' shipping addresses via insecure direct object references in the member address API. Attackers can enumerate sequential address IDs to read, overwrite, or delete recipient information such as names, phone numbers, and addresses. Join the discussion | CVE Database V5 | 10/13/2026, 18:30:55 UTC Added: 10/13/2026, 17:04:22 UTC |
0 yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files. Join the discussion | CVE Database V5 | 09/09/2026, 00:00:00 UTC Added: 09/10/2026, 11:04:41 UTC |
A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. Join the discussion | CVE Database V5 | 02/08/2026, 09:32:07 UTC Added: 02/08/2026, 09:45:12 UTC |
0 A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. Join the discussion | CVE Database V5 | 01/09/2026, 17:02:12 UTC Added: 01/09/2026, 17:10:21 UTC |
Showing 1 to 5 of 5 results