EV
Product
Evershop
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 4Medium 6Low 1
Watch
Add Evershop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-28213 | 9.8 | Feb 26 | EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response Affected: before 2.1.1 |
| CVE-2026-25993 | 9.8 | Feb 10 | EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys Affected: through 2.1.0 |
| CVE-2023-46498 | 9.8 | Dec 8 | An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2023-46943 | 9.1 | Jan 13 | An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8 Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2023-46496 | 8.3 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2025-67419 | 7.5 | Jan 5 | A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API Affected: through 2.1.0 |
| CVE-2025-65844 | 7.5 | Dec 2 | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint Affected: 2.0.1 |
| CVE-2023-46942 | 7.5 | Jan 13 | Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2025-67427 | 6.5 | Jan 5 | A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET… Affected: through 2.1.0 |
| CVE-2023-46499 | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more |
| CVE-2023-46495 | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2023-46494 | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more |
| CVE-2023-46497 | 5.4 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2023-46493 | 5.3 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more |
| CVE-2025-12919 | 3.7 | Nov 9 | A vulnerability was detected in EverShop up to 2.0.1 Affected: through 2.0.1 |
Showing 15