Advisories · Technology
MStore API.
Every CVE that names MStore API among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
- MStore API
- Broken access control
- CVSS 6.5 Medium
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
- MStore API
- Broken access control
- CVSS 6.5 Medium
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
- MStore API
- Broken access control
- CVSS 7.5 High
MStore API < 4.21.0 - Unauthenticated Product Review Creation
- MStore API
- Broken access control
- CVSS 6.5 Medium
MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
- MStore API
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways
- MStore API
- Broken access control
- CVSS 8.1 High
MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication
- MStore API
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress MStore API 2.0.6 Arbitrary File Upload
- MStore API
- Authentication bypass
-
MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update
- MStore API
-
MStore API < 3.9.7 - Settings Update via CSRF
- MStore API
-
MStore API < 3.9.8 - Unauthenticated Blind SQLi
- MStore API
-
MStore API < 3.9.9 - Unauthenticated Privilege Escalation
- MStore API
-
MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple
- MStore API
- Authentication bypass