evershopcommerce has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 8.6 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Weakness classes
Products
- evershop 2
Worst active — by depth score
CVE-2026-72843Critical· 9.8The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the calle…54CVE-2026-115323High· 7.3EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API40
evershopcommerce vulnerabilities
CVEs affecting evershopcommerce, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-115323High· 7.3EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POS…
CVE-2026-72843Critical· 9.8The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the calle…
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the calle…