CVE-2026-90571

Exrick xmall Order Printing order-print.jsp cross site scripting

State: Published
Severity: 5.3 Medium
Published: Sep 13, 2026
Updated: Sep 14, 2026
Reserved: Sep 12, 2026

Description

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
xmallExrick	19e7917d5ed3bd2a2421a3a246ad494c133ba94cAffected

References

VDB-403156 | Exrick xmall Order Printing order-print.jsp cross site scriptingvdb-entry
VDB-403156 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-90571 | CVE Analysis and Reportthird-party-advisory
Submit #912676 | Exrick xmall 1.1; source through 19e7917 Cross Site Scriptingthird-party-advisory
https://github.com/Exrick/xmall/issues/104issue-tracking
https://github.com/Exrick/xmall/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.