ShopEx

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

ShopEx records in CISA KEV

No ShopEx vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ecshop 15 records HIGH

Records

17 records

TI-2023-04869 CVE-2023-5294 · GHSA-wghh-rw2v-wf6q

ECshop order.php sql injection

HIGH 73

A vulnerability has been found in ECshop 4.1.1 and classified as critical.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00661 Published 2023-09-29 No fix listed CWE-89

TI-2026-57207 CVE-2026-82922 · GHSA-f5x9-jgf8-wfg7

ShopEx ECShop flow.php flow_update_cart sql injection

HIGH 70

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00411 Published 2026-08-31 No fix listed CWE-74

TI-2026-57206 CVE-2026-82921 · GHSA-2r69-3cfm-2cc4

ShopEx ECShop pack.php check_img_type unrestricted upload

HIGH 70

A weakness has been identified in ShopEx ECShop up to 2.5.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00472 Published 2026-08-31 No fix listed CWE-284

TI-2021-19515 CVE-2021-43679 · GHSA-prv3-crch-qf6r

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.

MEDIUM 45

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01627 Published 2021-12-02 No fix listed CWE-89

TI-2020-14299 CVE-2020-22206 · GHSA-5x4c-vmgh-24rc

SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.

MEDIUM 45

SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2021-06-16 No fix listed CWE-89

TI-2020-14298 CVE-2020-22205 · GHSA-9x92-m3f9-q66r

SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.

MEDIUM 45

SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2021-06-16 No fix listed CWE-89

TI-2020-14297 CVE-2020-22204 · GHSA-jg2r-w2w3-cg2m

SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php.

MEDIUM 45

SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01449 Published 2021-06-16 No fix listed CWE-89

TI-2023-00743 CVE-2023-0783 · GHSA-hrg3-j69q-jrj9

EcShop PHP File template.php unrestricted upload

MEDIUM 44

A vulnerability was found in EcShop 4.1.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00875 Published 2023-02-11 No fix listed CWE-434

TI-2021-18241 CVE-2021-41460 · GHSA-4wmj-crxg-xx43

ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.

MEDIUM 42

ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06728 Published 2022-06-28 No fix listed CWE-89

TI-2024-01427 CVE-2024-1530 · GHSA-423h-q743-cc99

ECshop view_sendlist.php sql injection

LOW 39

A vulnerability, which was classified as critical, has been found in ECshop 4.1.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00594 Published 2024-02-15 No fix listed CWE-89

TI-2023-01120 CVE-2023-1185 · GHSA-j8wp-62vq-268h

ECshop New Product unrestricted upload

LOW 39

A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00746 Published 2023-03-06 No fix listed CWE-434

TI-2023-01119 CVE-2023-1184 · GHSA-2f9c-7w3q-922p

ECshop Backup Database database.php unrestricted upload

LOW 39

A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00746 Published 2023-03-06 No fix listed CWE-434

TI-2010-01958 CVE-2010-2042 · GHSA-5w97-7pfp-2c5r

SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to…

LOW 35

SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00973 Published 2010-05-25 No fix listed CWE-89

TI-2023-20298 CVE-2023-39112 · GHSA-2q8f-prcf-5f4c

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.

LOW 32

ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00699 Published 2023-08-04 No fix listed CWE-287

TI-2023-04868 CVE-2023-5293 · GHSA-qx55-87x4-r7qf

ECshop leancloud.php sql injection

LOW 30

A vulnerability, which was classified as critical, was found in ECshop 4.1.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00534 Published 2023-09-29 No fix listed CWE-89

TI-2020-13895 CVE-2020-20640 · GHSA-v739-645c-vfcr

Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues…

LOW 29

Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00876 Published 2021-06-28 No fix listed CWE-79

TI-2024-23397 CVE-2024-35362 · GHSA-68wx-vmj5-rjxj

Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.

LOW 24

Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2024-05-22 No fix listed CWE-79

Open these records in search →

Critical	5
High	6
Medium	6
Low	0
No CVSS	0