EverShop 1.0.0 Beta 2 for NodeJS
Approved changes feed: RSS · Atom
cpe:2.3:a:evershop:evershop:1.0.0:beta2:*:*:*:node.js:*:*part: a version: 1.0.0 update: beta2
| Vendor | Evershop (bbba128c-ffad-5315-8e81-98035ff57a1b) |
|---|---|
| Product | Evershop (05e3028e-951d-55b1-9dff-fb4823dd2e69) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/evershopcommerce/evershop |
purl2cpe | 2026-06-01 10:18:10.182290 |
pkg:npm/%40evershop/evershop |
purl2cpe | 2026-06-01 10:18:10.182292 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-46943 |
vulnerable | 2026-06-08 06:14:23.680645 |
Details available
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Published: 2024-01-13T00:00:00.000Z
Updated: 2024-08-30T19:08:51.910Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46942 |
vulnerable | 2026-06-08 06:14:23.672712 |
Details available
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
Published: 2024-01-13T00:00:00.000Z
Updated: 2025-06-03T14:03:22.652Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46499 |
vulnerable | 2026-06-08 06:12:45.239132 |
Details available
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
Published: 2023-12-08T00:00:00.000Z
Updated: 2024-11-26T17:10:02.034Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46498 |
vulnerable | 2026-06-08 06:12:45.238008 |
Details available
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
Published: 2023-12-08T00:00:00.000Z
Updated: 2024-08-02T20:45:41.984Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46497 |
vulnerable | 2026-06-08 06:12:45.236813 |
Details available
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.
Published: 2023-12-08T00:00:00.000Z
Updated: 2024-10-09T13:50:29.730Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46496 |
vulnerable | 2026-06-08 06:12:45.236068 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46495 |
vulnerable | 2026-06-08 06:12:45.235356 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46494 |
vulnerable | 2026-06-08 06:12:45.234506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46493 |
vulnerable | 2026-06-08 06:12:45.227947 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.