Veille CVE

Recherche « Shopizer »

3 CVE

Critique 1 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Shopizer » ✕
  1. CVE-2026-110771 4.3 Moyenne

    Shopizer

    Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.

  2. CVE-2026-36766 5.4 Moyenne

    Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions.

  3. CVE-2026-36767 10.0 Critique

    A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.