EV
Product
evershop
4
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 1Medium 0Low 0
Watch
Add evershop to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72843 | 9.8 | Aug 20 | EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover Affected: before 2.2.1 |
| CVE-2026-28213 | 9.8 | Feb 26 | EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response Affected: < 2.1.1 |
| CVE-2026-25993 | 9.8 | Feb 10 | EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys Affected: < 2.1.1 |
| CVE-2026-115323 New | 7.3 | Oct 22 | EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API Affected: 1.2.2 before 2.2.1 |
Showing 4