eBay's vulnerability profile centers on a small set of e-commerce and payment-related products, including image-handling services, the PayPal platform, and client-side components, with recurring exposure in authentication mechanisms and code-injection weaknesses including OS command injection and improper code generation. Live severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ebay over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-2475HIGH eBay Enhanced Picture Uploader ActiveX control (EPUWALcontrol.dll) before 1.0.27 allows remote attackers to execute arbitrary commands via the PictureUrls property. | Jun 9, 2009 | 9.3 | 28 | NO | NO |
CVE-2023-26107HIGH All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current d | Mar 6, 2023 | 7.8 | 24 | NO | NO |
CVE-2006-1176HIGH Buffer overflow in eBay Enhanced Picture Services (aka EPUImageControl Class) in EUPWALcontrol.dll before 1.0.3.48, as used in Sell Your Item (SYI), Setup & Test eBay Enhanced Pict | Jul 8, 2006 | 7.5 | 21 | NO | NO |
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attacker | Nov 9, 2010 | 2.9 | 14 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ebay.
Media articles that mention a CVE ID that affects a product developed by Ebay — matched by CVE ID, not by vendor name.