evershopcommerce evershop

• CVE-2026-115323 High 7.3 EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API 0.2%
• CVE-2026-72843 Critical 9.8 EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover 0.8%
• CVE-2026-28213 Critical 9.8 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response 0.5%
• CVE-2026-25993 Critical 9.3 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys 0.4%