evershop vulnerabilities

Products

• @evershop/evershop 16

Latest evershop CVEs

Newest publication first

1. CVE-2026-115323 EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API

   Published 2026-10-22

   Medium·CVSS 6.9 EPSS 0.24%

   EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/custom...

2. CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

   Published 2026-02-26

   Critical·CVSS 9.8 EPSS 0.49%

   EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated a...

3. CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

   Published 2026-02-10

   Critical·CVSS 9.3 EPSS 0.37%

   EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a...

4. CVE-2025-67427 evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API

   Published 2026-01-05

   Medium·CVSS 6.5 EPSS 0.21% PoC

   A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, w...

5. CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API

   Published 2026-01-05

   High·CVSS 7.5 EPSS 0.35% PoC

   A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tile...

6. CVE-2025-65844 EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and...

   Published 2025-12-02

   High·CVSS 7.5 EPSS 0.40%

   EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to...

7. CVE-2025-12919 EverShop Order Order.resolvers.js resource injection

   Published 2025-11-09

   Medium·CVSS 6.3 EPSS 0.50%

   A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The...

8. CVE-2023-46943 EverShop at risk to unauthorized access via weak HMAC secret

   Published 2024-01-13

   Critical·CVSS 9.1 EPSS 0.50%

   An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), all...

9. CVE-2023-46942 EverShop vulnerable to improper authorization in GraphQL endpoints

   Published 2024-01-13

   High·CVSS 7.5 EPSS 0.73%

   Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

10. CVE-2023-46498 Code execution in evershop

    Published 2023-12-08

    Critical·CVSS 9.8 EPSS 1.3%

    An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.

11. CVE-2023-46499 Cross-site Scripting in evershop

    Published 2023-12-08

    Medium·CVSS 6.1 EPSS 0.49%

    Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.

12. CVE-2023-46497 Directory Traversal in evershop

    Published 2023-12-08

    Medium·CVSS 5.4 EPSS 0.79%

    Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.

13. CVE-2023-46496 Directory Traversal in evershop

    Published 2023-12-08

    High·CVSS 8.3 EPSS 1.2%

    Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.

14. CVE-2023-46494 Cross Site Scripting in evershop

    Published 2023-12-08

    Medium·CVSS 6.1 EPSS 0.49%

    Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.

15. CVE-2023-46495 Cross-site Scripting in evershop

    Published 2023-12-08

    Medium·CVSS 6.1 EPSS 0.49%

    Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.

16. CVE-2023-46493 Directory Traversal in evershop

    Published 2023-12-08

    Medium·CVSS 5.3 EPSS 1.0%

    Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.