Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: evershopcommerce Clear all filters
TI-2026-79260 CVE-2026-115323 · GHSA-9rjv-95rj-93cg

EverShop customer API missing authorization lets attackers change addresses

Priority LOW 36

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00242 Published 2026-10-22 Fixed in 2.2.1 CWE-862
TI-2026-51069 CVE-2026-72843 · GHSA-m3qj-pp48-6w2p

EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

Priority MEDIUM 50

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without c…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00837 Published 2026-08-20 Fixed in 2.2.1 CWE-862