Cpe:2.3:a:coreshop:coreshop:*:*:*:*:*:*:*:*

CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.