CVE-2024-35362

Ecshop 3.6 is affected by a Cross-Site Scripting (XSS) flaw in ecshop/article_cat.php. Multiple sources (NVD, Red Hat, CVE records) confirm a reflective XSS issue reported for Ecshop 3.6. The CVSS v3.1 base score is 5.4 (Medium) with Network attack vector, required Privileges and User Interaction...

CVE-2021-41460

ECShop 4.1.0 is affected by CVE-2021-41460 due to an SQL injection vulnerability (CWE-89). The issue allows arbitrary SQL queries, potentially leading to data leakage or unauthorized access. The Nuclei template confirms the vulnerability and notes remediation: upgrade to a newer ECShop version or...

CVE-2023-5293

ECshop 4.1.5 is affected by a SQL injection in /admin/leancloud.php triggered by manipulating the id parameter. The vulnerability enables remote exploitation and has been publicly disclosed (CVE-2023-5293). Exploitation details across sources consistently point to an injection in an unknown funct...

CVE-2023-0783

Summary (CVE-2023-0783): EcShop 4.1.5 is affected by a vulnerability in the PHP File Handler, specifically the /ecshop/admin/template.php file, enabling unrestricted upload. Remote initiation is possible; the vulnerability is publicly disclosed (VDB-220641) and reported across multiple feeds (NVD...

CVE-2020-20640

The CVE-2020-20640 entry describes a Cross Site Scripting (XSS) vulnerability in ECShop 4.0, triggered via the user.php file by bypassing the safety.php security policy through HTML entity encoding. The issue arises from security filtering gaps, enabling XSS (no full details on exploitation metho...

CVE-2023-1185

ECshop up to version 4.1.8 contains a vulnerability in the New Product Handler that allows unrestricted file uploads. The issue can be exploited remotely and the exploit has been disclosed publicly. A remediation is available: upgrade ECshop to a version later than 4.1.8; as a temporary workaroun...

CVE-2020-22205

ECShop 3.0 contains a SQL injection vulnerability in the admin/shophelp.php endpoint, exploitable via the id parameter (CVE-2020-22205). Multiple connected sources (CNVD-2021-44948, RH-Red Hat, NVD, CVE lists) describe the attack vector as injecting through id in admin/shophelp.php, enabling SQL ...

CVE-2023-5294

CVE-2023-5294 affects ECshop 4.1.1. The vulnerability is an SQL injection in the admin function, caused by manipulating the goods_id parameter in the file /admin/order.php. This can be exploited remotely and the exploit has been disclosed publicly. Several connected sources corroborate ECshop 4.1...

CVE-2020-22206

CVE-2020-22206: SQL injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. Affected software: ECShop 3.0. Root cause is unparameterized SQL in the affiliate_ck.php path. Reported impact in sources aligns with high/critical severity (NVD metrics: CVSS v2 base score 7.5; CVSS v3.1...

CVE-2021-43679

CVE-2021-43679 affects ecshop v2.7.3. A SQL injection vulnerability exists in shopex\ecshop\upload\api\client\api.php, stemming from lack of input validation in database queries and allowing arbitrary SQL execution per referenced CNVD/CVE entries. The CVSS metrics indicate high severity (CRITICAL...

CVE-2020-22204

CVE-2020-22204 describes a SQL injection vulnerability in ECShop 2.7.6 exploitable via the goods_number parameter of flow.php. The included connected sources (CNVD/CNNVD/NVD entries) confirm ECShop 2.7.6 is affected and that the injection occurs through a poorly sanitized goods_number parameter. ...

CVE-2023-1184

ECshop up to 4.1.8 is affected in the Backup Database Handler (admin/database.php), where a vulnerability allows unrestricted remote file upload. Root cause details are not fully disclosed in the provided documents. Impact is high (arbitrary file upload, remote execution risk) per the referenced ...

CVE-2023-39112

ECShop v4.1.16 has an arbitrary file deletion vulnerability in the Admin Panel (CVE-2023-39112). Public sources confirm the affected product/version and impact on integrity and availability, with CVSS 3.1 metrics: I:H, A:H, C:N; no details on root cause in the provided documents. No exploitation ...

CVE-2024-1530

CVE-2024-1530 affects ECshop 4.1.8. The vulnerability is in an unknown functionality of the file /admin/view_sendlist.php, where manipulation leads to a SQL injection. The issue can be exploited remotely, and multiple sources note that the exploit has been disclosed publicly. Remediation details ...

CVE-2010-2042

ECShop 2.7.2 has an SQL injection in search.php via the encode parameter, allowing remote execution of arbitrary SQL commands. Affected component: ECShop (version 2.7.2); vulnerability arises from improper handling in search.php. Impact details and remediation steps are not provided in the suppli...