Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side Product Pagination Endpoint. Performing a manipulation of the argument sortField/sort results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-3287 A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai… https://www.cve.org/CVERecord?id=CVE-2026-3287
Post summary
A new vulnerability, CVE-2026-3287, has been discovered in youlaitech youlai-mall 2.0.0, affecting the listPagedSpuForApp function.
CVE-2026-3287 SQL Injection Vulnerability in Youlai-Mall 2.0.0 App-side Product Pagination Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3287
Post summary
A SQL injection vulnerability (CVE-2026-3287) was disclosed in Youlai-Mall 2.0.0, affecting the app-side product pagination endpoint. No evidence of exploitation, patch, or PoC is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | youlai | youlai-mall | 2.0.0 | - | - |