Linlinjava · Litemall · CVE-2026-8771
**Name of the Vulnerable Software and Affected Versions**
linlinjava litemall versions prior to 1.8.1
**Description**
A SQL injection flaw exists in the Front-end WeChat API component. The issue is located in the `list()` function within the file `litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxGoodsController.java`. This flaw allows remote attackers to perform manipulations that result in unauthorized SQL command execution.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, consider restricting access to the `list()` function in the `WxGoodsController.java` file to minimize the risk of exploitation.