Geeeeeeeek maintains a small portfolio of web-based application products, including Dingfanzu and Java Shop, with a durable pattern of vulnerabilities centered on application-layer input handling and access control. The recurring weakness classes span SQL injection, authorization bypass, cross-site request forgery, and unrestricted file uploads, characteristic of web frameworks where input validation and session management are critical.
The number and severity of CVEs published that impact products developed by Geeeeeeeek over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-28100CRITICAL A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter. | Apr 15, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-8302CRITICAL A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of th | Aug 29, 2024 | 9.8 | 25 | NO | NO |
CVE-2024-50651MEDIUM java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. | Nov 15, 2024 | 6.5 | 19 | NO | NO |
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop | Sep 8, 2025 | 3.7 | 16 | NO | NO |
CVE-2024-50652MEDIUM A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function. | Nov 15, 2024 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Geeeeeeeek.
Media articles that mention a CVE ID that affects a product developed by Geeeeeeeek — matched by CVE ID, not by vendor name.