Approved changes feed: RSS · Atom
cpe:2.3:a:evershop:evershop:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Evershop (bbba128c-ffad-5315-8e81-98035ff57a1b) |
|---|---|
| Product | Evershop (05e3028e-951d-55b1-9dff-fb4823dd2e69) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/evershopcommerce/evershop |
purl2cpe | 2026-06-01 10:18:10.182286 |
pkg:npm/%40evershop/evershop |
purl2cpe | 2026-06-01 10:18:10.182289 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115323 |
vulnerable | 2026-11-03 10:15:37.726659 |
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
HIGH (7.3)
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
Published: 2026-10-22T10:57:42.424Z
Updated: 2026-10-29T02:08:25.891Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12919 |
vulnerable | 2026-06-08 07:04:31.198749 |
EverShop Order Order.resolvers.js resource injection
LOW (3.7)
A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-11-09T20:02:06.116Z
Updated: 2026-02-24T06:25:20.029Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.