PT-2026-7887 · Unknown · Newbee-Mall

Lennon Chia · Publicado 2026-02-12 · Atualizado 2026-02-25 · CVE-2026-26218

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions newbee-mall (affected versions not specified)

Description The application includes pre-seeded administrator accounts in its database initialization script, which are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change these default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application. The application’s database contains default admin accounts with predictable passwords.

Recommendations Change the default administrative credentials to prevent unauthorized access.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-26218

Produtos afetados

Newbee-Mall

Referências · 9

• https://github.com/newbee-ltd/newbee-mall/issues/119 · Aviso do Fabricante
• https://vulncheck.com/advisories/newbee-mall-default-seeded-administrator-credentials-allow-account-takeover · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26218 · Nota de Segurança
• https://twitter.com/CVEnew/status/2022037607375335786 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2022055980595331095 · Publicação no Twitter
• https://t.me/cveNotify/153181 · Publicação no Telegram
• https://t.me/CVEtracker/44559 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-26218 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2023156551402312119 · Publicação no Twitter