Read the docs

hikashop.com

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

hikashop.com records in CISA KEV

No hikashop.com vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hikashop 5 records HIGH

Records

7 records

TI-2025-16121 CVE-2025-22210 · GHSA-fvx6-jx94-49qx

Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla

Priority HIGH 67

A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00507 Published 2025-02-25 No fix listed CWE-89
TI-2025-18893 CVE-2025-25225 · GHSA-7g59-jc75-3559

Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla

Priority LOW 30

A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.

CVSS 3.1MEDIUM 6.5 Local High privileges User interaction EPSS 0.0016 Published 2025-03-15 No fix listed CWE-284
TI-2026-44290 CVE-2026-61901 · GHSA-vr3h-j7mq-24mm

Open redirect in hikashop.com Hikashop extension for Joomla

Priority LOW 27

Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0024 Published 2026-07-20 No fix listed CWE-601
TI-2024-27141 CVE-2024-40746 · GHSA-57xc-4245-hh9c

Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

Priority LOW 24

A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `descri…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00283 Published 2024-10-21 No fix listed CWE-79
TI-2023-30637 CVE-2023-54364 · GHSA-3xvv-wvr8-288m

Joomla HikaShop 4.7.4 Reflected XSS via Product Filter

Priority LOW 23

Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00235 Published 2026-04-09 No fix listed CWE-79
Open these records in search →