Advisories · Technology
evershop.
Every CVE that names evershop among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
- evershop
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover
- evershop
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
- evershop
- Information disclosure
- CWE-640
- CVSS 9.3 CriticalCritical · CVSS 9+
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
- evershop
- SQL injection