VulnerabilityDeferred
CVE-2026-75308
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS).
UnscoredEPSS 0.14%
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.
- CVSS
- Not yet scored
- EPSS
- 0.14% probability · 3th percentile
- CISA KEV
- Not listed
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.