CVE-2024-28560

5.4 mediumEPSS 0.5%

Medium (5.4) in niushop b2b2c multi-business. EPSS 0.5% chance of exploitation in the next 30 days.

SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php component.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2024-03-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

niushop:b2b2c_multi-business

References

https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559
https://gitee.com/niushop-team/niushop_b2c_v5
https://v5.niuteam.cn
https://www.niushop.com/
https://chiggerlor.substack.com/p/cve-2024-28560-cve-2024-28559

Check your stack JSON