CVE-2026-119655: CoreUnion CoreShop (High, CVSS 8.7)
- CVSS
- 8.7 High (v4.0)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- None reported in public exploit databases
- Weakness
- CWE-89
- Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Published
- Oct 30, 2026
What it is
CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.
Description from the National Vulnerability Database.
What to do
Check whether you run CoreUnion CoreShop, then apply the vendor’s fix or mitigation from the advisories below.
Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.