vendure records
3 published records for vendor vendure.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 66.7%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-20 Improper Input Validation1
- CWE-202 Exposure of Sensitive Information Through Data Queries1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
3 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
54Plan | CVE-2024-48914Proof of concept | Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyvendure-ecommerce · vendure · CWE-20 | Critical9.1 | — | 60.4% | Oct 15, 2024 |
21Monitor | CVE-2022-23065No exploit | Vendure - XSS via SVG File Uploadvendure · vendure · CWE-79 | Medium5.4 | — | 0.6% | May 2, 2022 |
10Monitor | CVE-2026-25050Proof of concept | Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyvendure · vendure · CWE-202 | Low2.7 | — | 0.4% | Jan 30, 2026 |
- CVE-2024-4891454Plan
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
CriticalCVSS 9.1Proof of conceptEPSS 60%vendure-ecommerce · vendureOct 15, 2024
- CVE-2022-2306521Monitor
Vendure - XSS via SVG File Upload
MediumCVSS 5.4No exploitEPSS 0%vendure · vendureMay 2, 2022
- CVE-2026-2505010Monitor
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
LowCVSS 2.7Proof of conceptEPSS 0%vendure · vendureJan 30, 2026