TI-2024-00319 CVE-2024-0352 · GHSA-hq93-g2wv-xwjm
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
Priority CRITICAL 86
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.
likeshop
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
likeshop records in CISA KEVNo likeshop vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Likeshop · all components
TI-2024-23154 CVE-2024-34949
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…
Priority HIGH 77
SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order/lists.html endpoint.
TI-2024-15979 CVE-2024-24027 · GHSA-666p-vffc-r2ch
SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL…
Priority HIGH 67
SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists.
TI-2024-27620 CVE-2024-41432 · GHSA-v66p-qc5x-9g87
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.
Priority MEDIUM 63
An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.
TI-2024-15980 CVE-2024-24028 · GHSA-3537-379x-x582
Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows…
Priority LOW 26
Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWechatInfo.
TI-2024-05353 CVE-2024-5766 · GHSA-x3p6-qcrr-6pv2
Likeshop Merchandise admin cross site scripting
Priority LOW 23
A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic.