SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-75308

MEDIUM · CVSS 6.1 EPSS 0.14% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

The vulnerability in yshopmall versions up to 3.3 allows attackers to exploit the file upload endpoint (/api/upload) due to inadequate file type validation, enabling the upload of malicious files such as HTML and JSP. This can lead to Cross Site Scripting (XSS) attacks, potentially compromising user data and session integrity. Organizations using this software should prioritize remediation to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-75308
Severity
MEDIUM
CVSS
6.1
EPSS
0.14%

Original NVD Description

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of the system lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.