Login Request a demo
EV
Product
EverShop
by Evershop · last CVE Feb 26, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 4High 4Medium 6Low 1
Severity
All severities15Critical4High4Medium6Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add EverShop to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-28213
9.8
0%
Feb 26
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
Affected: before 2.1.1
CVE-2026-25993
9.8
0%
Feb 10
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
Affected: through 2.1.0
CVE-2023-46498
9.8
1%
Dec 8
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more
CVE-2023-46943
9.1
0%
Jan 13
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more
Showing 4