Skip to content
OpenAdvisories

Vendor

evershopcommerce

4 known vulnerabilities.

evershopcommerce at a glance

Last 12 months
4
Critical · all time
3
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 2 vulnerabilities, 2 critical March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202611
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202622
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

evershop 4
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.3
    CVE-2026-115323

    EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API

    EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE re…

    evershopcommerce evershop
  • Critical 9.8
    CVE-2026-72843

    EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

    The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-ses…

    evershopcommerce evershop
  • Critical 9.8
    CVE-2026-28213

    EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

    EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take …

    evershopcommerce evershop
  • Critical 9.3
    CVE-2026-25993 Public exploit

    EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

    EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes th…

    evershopcommerce evershop