Evershopcommerce vulnerabilities
We track 4 vulnerabilities in Evershopcommerce products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Evershopcommerce vulnerabilities
- 7.3 High severity
evershop: Missing Authorization
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE req
- 9.8 Critical severity
evershop: Missing Authorization
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-sess
- 9.8 Critical severity
evershop: Weak Password Recovery Mechanism for Forgotten Password
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take o
- 9.8 Critical severity
evershop: Improper Neutralization of Special Elements used in an SQL Command
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes the