EverShop 2.0.1 for Node.js

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:evershop:evershop:2.0.1:*:*:*:*:node.js:*:*

part: a version: 2.0.1 update: *

VendorEvershop (bbba128c-ffad-5315-8e81-98035ff57a1b)
ProductEvershop (05e3028e-951d-55b1-9dff-fb4823dd2e69)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/evershopcommerce/evershop purl2cpe 2026-06-01 10:18:10.188692
pkg:npm/%40evershop/evershop purl2cpe 2026-06-01 10:18:10.188694

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-65844 vulnerable 2026-06-08 07:39:21.022468 Details available
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.
Published: 2025-12-02T00:00:00.000Z
Updated: 2025-12-06T03:51:57.318Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.