Tp-shop — known CVE vulnerabilities

Every CVE whose affected-product data names Tp-shop, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2018-9919 — CVSS 9.8 (critical): A web-accessible backdoor, with resultant SSRF, exists in Tp-shop 2.0.5 through 2.0.8, which allows remote attackers to obtain sensitive…
• CVE-2020-18164 — CVSS 9.8 (critical): SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.