CVE-2026-2165mediumCWE-287CWE-306

CVE-2026-2165: medium-severity vulnerability in detronetdip E-commerce

detronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication

Published · Updated

Follow this CVE+ Monitor E-commerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
detronetdip · E-commerce
Related CVEs — detronetdip E-commerce

In the same product, most dangerous first.

CVE-2026-2164MEDIUMdetronetdip E-commerce addadhar.php unrestricted uploadEPSS 0.5%CVE-2025-15582MEDIUMdetronetdip E-commerce Product Management Update authorizationEPSS 0.4%CVE-2025-15583MEDIUMdetronetdip E-commerce function.php get_safe_value cross site scriptingEPSS 0.3%