CVE-2026-28213: falha crítica em evershopcommerce evershop
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.5%
EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
evershopcommerce · evershopCVEs relacionadas — evershopcommerce evershop
No mesmo produto, das mais perigosas para as menos.
CVE-2026-72843CRITICALEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account TakeoverEPSS 0.8%CVE-2026-25993CRITICALEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL KeysEPSS 0.4%CVE-2026-115323MEDIUMEverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address APIEPSS 0.2%