79 matches found
CVE-2026-56827
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:20+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh...
CVE-2026-56826
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:18+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57...
CVE-2026-56828
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:14+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3...
CVE-2026-56829
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:09+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f...
CVE-2026-56830
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:07+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3...
CVE-2026-56825
creationtimestamp| type| source ---|---|--- 2026-09-11 22:37:05+00:00| published-proof-of-concept| https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp...
Shopper: Missing authorization on product removal actions in CollectionProducts component
Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...
GHSA-2CG9-97GQ-9MQP Shopper: Missing authorization on product removal actions in CollectionProducts component
Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...
GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...
GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...
Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
GHSA-J328-XMGP-J4Q3 Shopper: privilege escalation via improper Livewire admin component authorization
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
GHSA-5VF4-452P-JJHF Shopper: Negative discount values accepted and propagated through order calculation pipeline
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
PT-2026-90547
Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...
PT-2026-90544
Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only view users permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...
PT-2026-90543
Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...
PT-2026-90541
Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...