Vendurehq Vendure vulnerabilities
- vendurehq vendureVendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions8.7 High
- vendurehq vendureVendure: Shop API list queries can return non-public entities when filterOperator is OR5.3 Medium
- vendurehq vendureVendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification9.1 Critical
- vendurehq vendureVendure: Unauthenticated ReDoS via `regex` filter on SQLite backends7.5 High
- vendurehq vendureVendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update6.1 Medium
- vendurehq vendure@vendure/core has a SQL Injection vulnerability9.1 Critical
- vendureVendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy2.7 Low
- vendureVendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy9.1 Critical
- vendureVendure - XSS via SVG File Upload5.4 Medium