likeshop

Records7All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

likeshop records in CISA KEV

No likeshop vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Likeshop 6 records CRITICAL

Records

7 records

TI-2024-00319 CVE-2024-0352 · GHSA-hq93-g2wv-xwjm

Likeshop HTTP POST Request File.php userFormImage unrestricted upload

CRITICAL 86

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72917 Published 2024-01-09 No fix listed CWE-434

TI-2024-23154 CVE-2024-34949

SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…

HIGH 77

SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0042 Published 2024-05-20 No fix listed CWE-89

TI-2024-15979 CVE-2024-24027 · GHSA-666p-vffc-r2ch

SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…

HIGH 67

SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00668 Published 2024-02-27 No fix listed CWE-89

TI-2024-27620 CVE-2024-41432 · GHSA-v66p-qc5x-9g87

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.

MEDIUM 63

An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00376 Published 2024-08-07 No fix listed CWE-290

TI-2026-75082 CVE-2026-111348

Likeshop AfterSale API IDOR exposes other customers' refund records

MEDIUM 57

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00273 Published 2026-10-15 No fix listed CWE-639

TI-2024-15980 CVE-2024-24028 · GHSA-3537-379x-x582

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows…

LOW 26

Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00217 Published 2024-02-29 No fix listed CWE-918

TI-2024-05353 CVE-2024-5766 · GHSA-x3p6-qcrr-6pv2

Likeshop Merchandise admin cross site scripting

LOW 23

A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00346 Published 2024-06-08 No fix listed CWE-79

Open these records in search →

Critical	1
High	2
Medium	4
Low	0
No CVSS	0