Approved changes feed: RSS · Atom
cpe:2.3:a:evershopcommerce:evershop:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Evershopcommerce (8ddb2193-2ace-5f99-9836-1f2fb080f3a3) |
|---|---|
| Product | Evershop (fb139ec6-095f-5075-9e5d-5bca64c11fa5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115323 |
vulnerable | 2026-11-03 10:15:37.725742 |
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
HIGH (7.3)
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
Published: 2026-10-22T10:57:42.424Z
Updated: 2026-10-29T02:08:25.891Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28213 |
vulnerable | 2026-06-08 07:55:15.007736 |
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
CRITICAL (9.8)
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
Published: 2026-02-26T22:31:47.122Z
Updated: 2026-02-27T18:51:10.647Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25993 |
vulnerable | 2026-06-08 07:53:20.671038 |
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds
path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
Published: 2026-02-10T17:43:38.998Z
Updated: 2026-02-10T19:29:56.966Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.