EV
Vendor
Evershop
15
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-28213 | EV Evershop Evershop | 9.8 | Feb 26 | EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response |
| CVE-2026-25993 | EV Evershop Evershop | 9.8 | Feb 10 | EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys |
| CVE-2025-67427 | EV Evershop Evershop | 6.5 | Jan 5 | A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET… |
| CVE-2025-67419 | EV Evershop Evershop | 7.5 | Jan 5 | A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API |
| CVE-2025-65844 | EV Evershop Evershop | 7.5 | Dec 2 | EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint |
| CVE-2025-12919 | EV Evershop Evershop | 3.7 | Nov 9 | A vulnerability was detected in EverShop up to 2.0.1 |
| CVE-2023-46943 | EV Evershop Evershop | 9.1 | Jan 13 | An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8 |
| CVE-2023-46942 | EV Evershop Evershop | 7.5 | Jan 13 | Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL… |
| CVE-2023-46499 | EV Evershop Evershop | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel |
| CVE-2023-46498 | EV Evershop Evershop | 9.8 | Dec 8 | An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file |
| CVE-2023-46497 | EV Evershop Evershop | 5.4 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync… |
| CVE-2023-46496 | EV Evershop Evershop | 8.3 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE… |
| CVE-2023-46495 | EV Evershop Evershop | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy… |
| CVE-2023-46494 | EV Evershop Evershop | 6.1 | Dec 8 | Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid… |
| CVE-2023-46493 | EV Evershop Evershop | 5.3 | Dec 8 | Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync… |