TI-2026-22548 CVE-2026-28213
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
Priority MEDIUM 49
EverShop is a TypeScript-first eCommerce platform.
Vulnerabilities
15 records
TI-2026-21008 CVE-2026-25993
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
Priority MEDIUM 46
EverShop is a TypeScript-first eCommerce platform.
TI-2025-41209 CVE-2025-67427 · GHSA-vp8w-wj4m-3r7j
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior…
Priority LOW 34
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API.
TI-2025-41208 CVE-2025-67419 · GHSA-m2q5-xhqg-92r2
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows…
Priority LOW 39
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API.
TI-2025-40481 CVE-2025-65844 · GHSA-c88j-gfxj-293x
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and…
Priority HIGH 72
EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint.
TI-2025-11836 CVE-2025-12919 · GHSA-c73g-mx2w-cc93
EverShop Order Order.resolvers.js resource injection
Priority MEDIUM 61
A vulnerability was detected in EverShop up to 2.0.1.
TI-2023-25344 CVE-2023-46943 · GHSA-32r3-57hp-cgfw
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8.
Priority MEDIUM 48
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8.
TI-2023-25343 CVE-2023-46942 · GHSA-ggpm-9qfx-mhwg
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8…
Priority MEDIUM 40
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
TI-2023-25040 CVE-2023-46499 · GHSA-gjj8-m83c-qv9h
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a…
Priority LOW 28
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
TI-2023-25039 CVE-2023-46498 · GHSA-5mmr-9qx3-3pf9
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain…
Priority MEDIUM 45
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
TI-2023-25038 CVE-2023-46497 · GHSA-7443-5962-wp4r
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a…
Priority LOW 26
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js…
TI-2023-25037 CVE-2023-46496 · GHSA-rwf3-w4jq-f4cm
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a…
Priority LOW 38
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.
TI-2023-25036 CVE-2023-46495 · GHSA-2xcj-557c-hf8r
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a…
Priority LOW 28
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.
TI-2023-25035 CVE-2023-46494 · GHSA-m6vm-ff9v-jp3r
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a…
Priority LOW 28
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.
TI-2023-25034 CVE-2023-46493 · GHSA-4wrm-qmq2-5fjx
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a…
Priority LOW 32
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.