Live › vulnerability › CVE-2026-119656
CoreShop, an e-commerce platform by CoreUnion, has an unauthenticated SQL injection in the api/Agent/GetGoodsPageList endpoint through the order parameter. Anonymous attackers can extract member accounts and orders using blind boolean or time-based techniques.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
CoreShop installations at version 1.5.5 or earlier that expose the api/Agent/GetGoodsPageList endpoint to the internet are exposed, since no login is needed. Stores that run CoreShop on an internal network only, or that have restricted this endpoint, face less risk. The sources do not say whether default configurations expose the endpoint.
No product ranges from the sources yet.
1.5.5 are described as affectedapi/Agent/GetGoodsPageList with an order parameter in web server logs1.5.5; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques.
This page as .md · .json · in your agent: get_signal("CVE-2026-119656")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.