Vendurehq vulnerabilities
Products
- Vendure 9
Newest
- vendurehq vendure Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions 8.7 High
- vendurehq vendure Vendure: Shop API list queries can return non-public entities when filterOperator is OR 5.3 Medium
- vendurehq vendure Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification 9.1 Critical
- vendurehq vendure Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends 7.5 High
- vendurehq vendure Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update 6.1 Medium
- vendurehq vendure @vendure/core has a SQL Injection vulnerability 9.1 Critical
- vendure Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy 2.7 Low
- vendure Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy 9.1 Critical
- vendure Vendure - XSS via SVG File Upload 5.4 Medium