Live › vulnerability › CVE-2026-119655
CoreShop, an e-commerce platform, does not validate the order parameter in its goods list API, which is appended to an ORDER BY clause. An unauthenticated attacker can inject subqueries and use blind techniques to extract member accounts and orders from the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Anyone running the CoreUnion CoreShop .NET mall system (v1.5.5 or earlier) with the WebApi reachable from the internet. No login is needed, and the default database, SQL Server, allows subqueries in ORDER BY, so an attacker can read the member, order and address tables. Pimcore CoreShop users, and installs with the WebApi not exposed to untrusted networks, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CoreShop (CoreUnion) | vendor | <= 1.5.5 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-119655")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.