Shopex Ecshop — known CVE vulnerabilities

Every CVE whose affected-product data names Shopex Ecshop, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (15)

• CVE-2021-43679 — CVSS 9.8 (critical): ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.
• CVE-2020-22204 — CVSS 9.8 (critical): SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. .
• CVE-2020-22205 — CVSS 9.8 (critical): SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.
• CVE-2020-22206 — CVSS 9.8 (critical): SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.
• CVE-2010-2042 — CVSS 7.5 (high): SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode…
• CVE-2021-41460 — CVSS 7.5 (high): ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.
• CVE-2023-39112 — CVSS 6.5 (medium): ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
• CVE-2024-1530 — CVSS 6.3 (medium): A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of…
• CVE-2020-20640 — CVSS 6.1 (medium): Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity…
• CVE-2024-35362 — CVSS 5.4 (medium): Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.
• CVE-2023-1185 — CVSS 4.7 (medium): A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New…
• CVE-2023-5293 — CVSS 4.7 (medium): A vulnerability, which was classified as critical, was found in ECshop 4.1.5. Affected is an unknown function of the file…
• CVE-2023-5294 — CVSS 4.7 (medium): A vulnerability has been found in ECshop 4.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of…
• CVE-2023-1184 — CVSS 4.7 (medium): A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown…
• CVE-2023-0783 — CVSS 4.7 (medium): A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file…