ZyWAC

3 exploits Active since Oct 2025
CVE-2025-66880 WRITEUP MEDIUM WRITEUP
Wethink 720yun pano-sdk 0.5.877 - XSS
Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Module 2093) and SignupComp (Module 2094) modules.
CVSS 6.1
CVE-2025-56161 WRITEUP HIGH WRITEUP
Yiovo Firefly Mall - Information Disclosure
YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.
CVSS 7.5
CVE-2025-56162 WRITEUP MEDIUM WRITEUP
Yiovo Firefly Mall - SQL Injection
YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges.
CVSS 6.5