Evershop vulnerabilities

Products

• Evershop 15

Newest

• evershop EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response CVE-2026-28213 9.8 CriticalFebruary 26, 2026
• evershop EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys CVE-2026-25993 Public exploit 9.3 CriticalFebruary 10, 2026
• evershop evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API CVE-2025-67427 6.5 MediumJanuary 5, 2026
• evershop evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API CVE-2025-67419 7.5 HighJanuary 5, 2026
• evershop EverShop 2.0.1 allows an unauthenticated user to upload files and create directories within the ... CVE-2025-65844 7.5 HighDecember 2, 2025
• evershop EverShop Order Order.resolvers.js resource injection CVE-2025-12919 6.3 MediumNovember 9, 2025
• evershop EverShop at risk to unauthorized access via weak HMAC secret CVE-2023-46943 Fix available 9.1 CriticalJanuary 13, 2024
• evershop EverShop vulnerable to improper authorization in GraphQL endpoints CVE-2023-46942 Fix available 7.5 HighJanuary 13, 2024
• evershop Cross-site Scripting in evershop CVE-2023-46499 Fix available 6.1 MediumDecember 8, 2023
• evershop Code execution in evershop CVE-2023-46498 Fix available 9.8 CriticalDecember 8, 2023
• evershop Directory Traversal in evershop CVE-2023-46497 Fix available 5.4 MediumDecember 8, 2023
• evershop Directory Traversal in evershop CVE-2023-46496 Fix available 8.3 HighDecember 8, 2023
• evershop Cross-site Scripting in evershop CVE-2023-46495 Fix available 6.1 MediumDecember 8, 2023
• evershop Cross Site Scripting in evershop CVE-2023-46494 Fix available 6.1 MediumDecember 8, 2023
• evershop Directory Traversal in evershop CVE-2023-46493 Fix available 5.3 MediumDecember 8, 2023