Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: shopizer-ecommerce Shopizer unspecified Clear all filters
TI-2022-07235 CVE-2022-23061 · GHSA-wf9v-5m62-rw7r

Shopizer - IDOR delete superadmin

Priority LOW 31

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.01131 Published 2022-05-01 No fix listed CWE-639
TI-2022-07234 CVE-2022-23060 · GHSA-r7gr-rcg6-hxhr

Shopizer - Stored XSS in Manage Files

Priority LOW 23

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged user (attacker) can inject malicious JavaScript in the filename under the “Manage files” tab

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00624 Published 2022-05-01 No fix listed CWE-79