Login Request a demo
EV
Product
EverShop
by Evershop · last CVE Feb 26, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 4High 4Medium 6Low 1
Severity
All severities15Critical4High4Medium6Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add EverShop to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-67427
6.5
0%
Jan 5
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET…
Affected: through 2.1.0
CVE-2023-46499
6.1
0%
Dec 8
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more
CVE-2023-46495
6.1
0%
Dec 8
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy…
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more
CVE-2023-46494
6.1
0%
Dec 8
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid…
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +3 more
CVE-2023-46497
5.4
1%
Dec 8
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync…
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more
CVE-2023-46493
5.3
1%
Dec 8
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync…
Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +6 more
Showing 6