Likeshop is a narrowly scoped e-commerce platform whose vulnerability profile concentrates in a single product and skews toward serious outcomes through a persistent cluster of application-layer weaknesses. The recurring exposure spans SQL injection, authentication bypass, cross-site scripting, server-side request forgery, and unrestricted file upload—issues characteristic of web applications with insufficient input validation and access control, and the platform frequently acquires public exploit code for its disclosures. Defenders treating this product as internet-facing should prioritize patches for these classes and restrict administrative access; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Likeshop over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-0352CRITICAL A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/ | Jan 9, 2024 | 9.8 | 76 | NO | YES |
CVE-2024-34949HIGH SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList function, exploited at the /admin/order | May 20, 2024 | 8.2 | 22 | NO | NO |
CVE-2024-24027HIGH SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic::getFansLists. | Feb 27, 2024 | 7.2 | 21 | NO | NO |
CVE-2024-24028MEDIUM Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar parameter in function UserLogic::updateWecha | Mar 21, 2024 | 5.9 | 18 | NO | NO |
CVE-2024-41432MEDIUM An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, spe | Aug 7, 2024 | 5.3 | 17 | NO | NO |
CVE-2024-5766MEDIUM A vulnerability was found in Likeshop up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin of the component Merchandise Handler. | Jun 8, 2024 | 4.8 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Likeshop.
Media articles that mention a CVE ID that affects a product developed by Likeshop — matched by CVE ID, not by vendor name.