Vulnerabilities

TI-2025-04578 CVE-2025-5108 · GHSA-963m-hgv5-33vg

zongzhige ShopXO ZIP File Payment.php Upload unrestricted upload

MEDIUM 57

A vulnerability was found in zongzhige ShopXO 6.5.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00434 Published 2025-05-23 No fix listed CWE-284

TI-2025-20712 CVE-2025-28094 · GHSA-24cf-848g-762c

shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.

MEDIUM 62

shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00229 Published 2025-03-28 No fix listed CWE-79

TI-2025-20711 CVE-2025-28093 · GHSA-gfhv-5rqh-7qx3

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.

MEDIUM 61

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00287 Published 2025-03-28 No fix listed CWE-918

TI-2025-20710 CVE-2025-28092 · GHSA-p736-g6pg-hjhw

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.

MEDIUM 61

ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00287 Published 2025-03-28 No fix listed CWE-918

TI-2025-19294 CVE-2025-26325 · GHSA-3qf8-ww35-9vjg

ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.

HIGH 82

ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00482 Published 2025-02-27 No fix listed CWE-434

TI-2025-01384 CVE-2025-1611 · GHSA-69hf-rc42-q74g

ShopXO Template ThemeAdminService.php injection

LOW 24

A vulnerability was found in ShopXO up to 6.4.0.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00573 Published 2025-02-24 No fix listed CWE-707

TI-2024-29959 CVE-2024-44682 · GHSA-3g7g-8ghp-wcmp

ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows…

LOW 27

ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00343 Published 2024-08-30 No fix listed CWE-79

TI-2024-06050 CVE-2024-6524 · GHSA-c96r-38gv-grp4

ShopXO Uploader.php server-side request forgery

MEDIUM 57

A vulnerability was found in ShopXO up to 6.1.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00483 Published 2024-07-05 No fix listed CWE-918

TI-2021-18498 CVE-2021-41938 · GHSA-86p5-97jr-r598

An issue was discovered in ShopXO CMS 2.2.0.

LOW 34

An issue was discovered in ShopXO CMS 2.2.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01067 Published 2022-05-19 No fix listed CWE-434

TI-2022-10882 CVE-2022-28056 · GHSA-jfph-3hpg-2f65

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via…

MEDIUM 45

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01413 Published 2022-05-02 Fixed in 2.2.6 CWE-732

TI-2020-15894 CVE-2020-26008 · GHSA-jh3c-3cqf-g2m3

The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO…

LOW 36

The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via uploading a crafted PHP file…

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01006 Published 2022-03-20 No fix listed CWE-434

TI-2020-15893 CVE-2020-26007 · GHSA-6q6w-vvgw-fj45

An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0…

LOW 36

An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01006 Published 2022-03-20 No fix listed CWE-434

TI-2020-13706 CVE-2020-19778 · GHSA-qx6j-79jh-2hvx

Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain…

MEDIUM 46

Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the parameter "user_id" in the HTML request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02105 Published 2021-04-14 No fix listed

TI-2021-09198 CVE-2021-27817 · GHSA-xx77-w6p5-xvmj

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload…

MEDIUM 48

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03227 Published 2021-03-15 No fix listed CWE-434

TI-2020-14848 CVE-2020-24220 · GHSA-pj6m-r633-m49w

ShopXO v1.8.1 has a command execution vulnerability.

MEDIUM 43

ShopXO v1.8.1 has a command execution vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02401 Published 2020-08-17 No fix listed CWE-78

TI-2019-04198 CVE-2019-5887 · GHSA-3gjx-5cjx-23r8

An issue was discovered in ShopXO 1.2.0.

LOW 36

An issue was discovered in ShopXO 1.2.0.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01536 Published 2019-01-10 No fix listed CWE-22

TI-2019-04197 CVE-2019-5886 · GHSA-mfr6-f95c-8chr

An issue was discovered in ShopXO 1.2.0.

MEDIUM 44

An issue was discovered in ShopXO 1.2.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00986 Published 2019-01-10 No fix listed CWE-667

Vulnerabilities

Filters