CVE-2025-12919
Low · 3.7CVSS
3.7
EPSS
0.5%
Published
Nov 9, 2025
CISA due date
—
The record
A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evershop/evershop | 0 | No fix |
Related vulnerabilities
- GHSA-c73g-mx2w-cc93 EverShop is vulnerable to Unauthorized Order Information Access (IDOR) Same vulnerability
- GHSA-m2q5-xhqg-92r2 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- GHSA-vp8w-wj4m-3r7j evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- CVE-2025-67427 evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639