Skip to content
OpenAdvisories

Vendor

evershopcommerce

4 known vulnerabilities.

Products

evershop 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-72843

    EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

    The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-ses…

    evershopcommerce evershop
  • Critical 9.8
    CVE-2026-28213

    EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

    EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take …

    evershopcommerce evershop
  • Critical 9.3
    CVE-2026-25993 Public exploit

    EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

    EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes th…

    evershopcommerce evershop