CVE-2026-28213

< 2.1.1

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functiona

9.8CRITICAL

CVE-2026-25993

<= 2.1.0

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path

9.8CRITICAL

CVE-2025-67427

<= 2.1.0

A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the

6.5MEDIUM

CVE-2025-67419

<= 2.1.0

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application se

7.5HIGH

CVE-2025-65844

all versions

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpo

7.5HIGH

CVE-2025-12919

<= 2.0.1

A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/O

3.7LOW

CVE-2023-46943

all versions

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens

9.1CRITICAL

CVE-2023-46942

all versions

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive

7.5HIGH

CVE-2023-46499

all versions

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive infor

6.1MEDIUM

CVE-2023-46498

all versions

An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitra

9.8CRITICAL

CVE-2023-46497

all versions

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive inform

5.4MEDIUM

CVE-2023-46496

all versions

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive inform

8.3HIGH

CVE-2023-46495

all versions

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive infor

6.1MEDIUM

CVE-2023-46494

all versions

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive infor

6.1MEDIUM

CVE-2023-46493

all versions

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive inform

5.3MEDIUM