Exrick has 4 CVEs on record between 2022 and 2026. 3 were published in the last 90 days. The median CVSS is 4.3 (medium). Most affected products: xboot (2), xmall (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-111689Medium· 4.3XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint36CVE-2026-111688Medium· 4.3Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false36CVE-2021-43432Medium· 6.1A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.34CVE-2026-90571Medium· 4.3A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c24
Exrick vulnerabilities
CVEs affecting Exrick, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-111688Medium· 4.3PoCExrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByP…
CVE-2026-111689Medium· 4.3PoCXBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{depart…
CVE-2026-90571Medium· 4.3A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c
A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performi…
CVE-2021-43432Medium· 6.1A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.
A Cross Site Scripting (XSS) vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp.