Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: hikashop.com Clear all filters
TI-2026-44290 CVE-2026-61901 · GHSA-vr3h-j7mq-24mm

Open redirect in hikashop.com Hikashop extension for Joomla

Priority LOW 27

Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0024 Published 2026-07-20 No fix listed CWE-601
TI-2023-30637 CVE-2023-54364 · GHSA-3xvv-wvr8-288m

Joomla HikaShop 4.7.4 Reflected XSS via Product Filter

Priority LOW 23

Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00235 Published 2026-04-09 No fix listed CWE-79
TI-2025-18893 CVE-2025-25225 · GHSA-7g59-jc75-3559

Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla

Priority LOW 30

A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.

CVSS 3.1MEDIUM 6.5 Local High privileges User interaction EPSS 0.0016 Published 2025-03-15 No fix listed CWE-284
TI-2025-16121 CVE-2025-22210 · GHSA-fvx6-jx94-49qx

Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla

Priority HIGH 67

A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00507 Published 2025-02-25 No fix listed CWE-89
TI-2024-27141 CVE-2024-40746 · GHSA-57xc-4245-hh9c

Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

Priority LOW 24

A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `descri…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00283 Published 2024-10-21 No fix listed CWE-79