Sshopperlabs

Products

Exploited and recent CVEs

• CVE-2026-62991 Medium 6.5 Shopper: customer detail IDOR exposes administrator and staff records 0.2%
• CVE-2026-62990 High 8.7 Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation 0.2%
• CVE-2026-62989 High 8.1 Shopper: missing variant-delete authorization permits destructive single and bulk actions 0.3%
• CVE-2026-56828 High 8.8 Shopper: read-only team permissions allow administrator creation and permission escalation 0.4%
• CVE-2026-114387 High 8.8 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components 0.3%
• CVE-2026-56826 Medium 5.4 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration 0.3%
• CVE-2026-56830 Medium 6.5 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization 0.4%
• CVE-2026-56831 Medium 6.5 Shopper: Negative discount values accepted and propagated through order calculation pipeline 0.4%
• CVE-2026-56827 High 8.1 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers 0.5%
• CVE-2026-56829 High 8.1 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component 0.5%
• CVE-2026-56825 High 8.1 Shopper: Missing authorization on product removal actions in CollectionProducts component 0.5%
• CVE-2026-47743 High 8.7 Shopper: Multiple data integrity and disclosure issues in admin Livewire components 0.4%
• CVE-2026-47740 High 8.1 Shopper: Authorization bypass in multiple Livewire admin components 0.3%
• CVE-2026-47741 Medium 5.9 Shopper: Race condition on Discount.usage_limit allows silent over-redemption 0.2%
• CVE-2026-47742 Medium 6.5 Shopper: Missing authorization on Product admin Livewire sub-form components 0.2%
• CVE-2026-47744 Critical 9.9 Shopper: Authorization bypass and RBAC privilege escalation in team settings 0.3%
• CVE-2026-47745 Medium 6.5 Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables 0.2%