Vendor
CoreShop versions 1.5.5 and earlier contain an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint, allowing attackers to exfiltrate database contents via the order parameter.