GHSA-c73g-mx2w-cc93
Low · 3.7CVSS
3.7
EPSS
—
Published
Nov 9, 2025
CISA due date
—
The record
EverShop is vulnerable to Unauthorized Order Information Access (IDOR)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @evershop/evershop | 0 | No fix |
Related vulnerabilities
- CVE-2025-12919 A vulnerability was detected in EverShop up to 2.0.1. Same vulnerability
- GHSA-m2q5-xhqg-92r2 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- GHSA-vp8w-wj4m-3r7j evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via… Also affects @evershop/evershop
- CVE-2025-67427 evershop allows unauthenticated attackers to force server to initiate HTTP request via… Also affects @evershop/evershop
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639