CVE-2026-110771

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

CVE-2026-110771 Shopizer through 3.2.5 Authorization Bypass via Product Review customerId

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

EUVD-2026-101571

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

CVE-2026-110771 Shopizer through 3.2.5 Authorization Bypass via Product Review customerId

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

CVE-2026-110771

Versions of Shopizer up to and including 3.2.5 are vulnerable to an authorization bypass (CWE-639) within the product review system. The vulnerability exists because the application fails to properly validate the customerId field when processing requests. An authenticated customer can send a craf...

CVE-2026-110771: Authorization Bypass Through User-Controlled Key

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/id/reviews to publish reviews and ratings attributed to...

Shopizer Detection

Detects Shopizer Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Shopizer Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Shopizer Detection', 'description': 'Detects Shopizer Detection.',...

CVE-2026-36767

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request...

CVE-2026-36766

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

Cross-site Scripting (XSS)

Overview com.shopizer:shopizer is an open source e-commerce software. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getInputStream or getReader functions in the XssHttpServletRequestWrapper class. An attacker can inject and execute arbitrary web scripts or...

Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

GHSA-FQCW-2XHJ-P63G Shopizer is vulnerable to Cross-site Scripting

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer through version 3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

GHSA-F5W4-7CCJ-5M75 Shopizer has a path traversal issue

A path traversal vulnerability in the /content/images/add endpoint of shopizer through version 3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request...

Directory Traversal

Overview com.shopizer:shopizer is an open source e-commerce software. Affected versions of this package are vulnerable to Directory Traversal through the /api/v1/private/content/images/add endpoint when processing crafted POST requests while configured with the httpd local filesystem storage...

Shopizer has a path traversal issue

A path traversal vulnerability in the /content/images/add endpoint of shopizer through version 3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request...

CVE-2026-36766

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

CVE-2026-36767

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request...

CVE-2026-36766

The shopizer open-source e-commerce solution, specifically version v3.2.5 , contains multiple authenticated cross-site scripting (XSS) vulnerabilities within the XssHttpServletRequestWrapper class. The root cause is the improper neutralization of input, which allows an authenticated attacker to i...

PT-2026-36156

Multiple authenticated cross-site scripting XSS vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream or getReader functions...

CVE-2026-36767

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request...