Skip to content
Noroxi

ShopEx records

16 published records for vendor shopex.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

16 records
  • CVE-2021-43679
    39Monitor

    ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    shopex · ecshopDec 2, 2021

  • CVE-2020-22204
    39Monitor

    SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    shopex · ecshopJun 16, 2021

  • CVE-2020-22205
    39Monitor

    SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    shopex · ecshopJun 16, 2021

  • CVE-2020-22206
    39Monitor

    SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    shopex · ecshopJun 16, 2021

  • CVE-2023-0783
    39Monitor

    EcShop PHP File template.php unrestricted upload

    CriticalCVSS 9.8No exploitEPSS 0%

    shopex · ecshopFeb 11, 2023

  • CVE-2023-1185
    35Monitor

    ECshop New Product unrestricted upload

    HighCVSS 8.8No exploitEPSS 0%

    shopex · ecshopMar 6, 2023

  • CVE-2023-1184
    35Monitor

    ECshop Backup Database database.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 0%

    shopex · ecshopMar 6, 2023

  • CVE-2023-5294
    35Monitor

    ECshop order.php sql injection

    HighCVSS 8.8No exploitEPSS 0%

    shopex · ecshopSep 29, 2023

  • CVE-2024-1530
    35Monitor

    ECshop view_sendlist.php sql injection

    HighCVSS 8.8No exploitEPSS 0%

    shopex · ecshopFeb 15, 2024

  • CVE-2021-41460
    32Monitor

    ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.

    HighCVSS 7.5Proof of conceptEPSS 6%

    shopex · ecshopJun 28, 2022

  • CVE-2010-2042
    30Monitor

    SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter

    HighCVSS 7.5Proof of conceptEPSS 0%

    shopex · ecshopMay 25, 2010

  • CVE-2024-31025
    30Monitor

    SQL Injection vulnerability in ECshop 4.x allows an attacker to obtain sensitive information via the file/article.php component.

    HighCVSS 7.5No exploitEPSS 0%

    Apr 4, 2024

  • CVE-2023-39112
    26Monitor

    ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.

    MediumCVSS 6.5No exploitEPSS 0%

    shopex · ecshopAug 4, 2023

  • CVE-2023-5293
    26Monitor

    ECshop leancloud.php sql injection

    MediumCVSS 6.5No exploitEPSS 0%

    shopex · ecshopSep 29, 2023

  • CVE-2020-20640
    24Monitor

    Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity en

    MediumCVSS 6.1No exploitEPSS 0%

    shopex · ecshopJun 28, 2021

  • CVE-2024-35362
    21Monitor

    Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.

    MediumCVSS 5.4No exploitEPSS 0%

    shopex · ecshopMay 22, 2024