https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28213.htmlhttps://patchthecve.com/cve/CVE-2026-28213.htmlWed, 17 Jun 2026 10:28:20 +0000CRITICAL 9.8: EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.https://patchthecve.com/cve/CVE-2026-25993.htmlhttps://patchthecve.com/cve/CVE-2026-25993.htmlWed, 17 Jun 2026 10:25:33 +0000CRITICAL 9.8: EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicihttps://patchthecve.com/cve/CVE-2025-67427.htmlhttps://patchthecve.com/cve/CVE-2025-67427.htmlWed, 17 Jun 2026 09:57:39 +0000MEDIUM 6.5: A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits arbitrahttps://patchthecve.com/cve/CVE-2025-67419.htmlhttps://patchthecve.com/cve/CVE-2025-67419.htmlWed, 17 Jun 2026 09:57:39 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the processhttps://patchthecve.com/cve/CVE-2025-65844.htmlhttps://patchthecve.com/cve/CVE-2025-65844.htmlWed, 17 Jun 2026 09:56:01 +0000HIGH 7.5: EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary cohttps://patchthecve.com/cve/CVE-2025-12919.htmlhttps://patchthecve.com/cve/CVE-2025-12919.htmlMon, 19 Oct 2026 13:10:00 +0000LOW 3.7: A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be perfo