Phpshe is a small e-commerce platform vendor whose vulnerability footprint centers on its mall system product and skews strongly toward critical-severity outcomes across its limited portfolio. The recurring exposure reflects characteristic weaknesses of web application frameworks: SQL injection, code injection, path traversal, cross-site scripting, and downstream injection flaws that are rooted in improper input handling and output neutralization. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpshe over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-9762CRITICAL A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. | Mar 14, 2019 | 9.8 | 38 | NO | YES |
CVE-2018-8943CRITICAL There is a SQL injection in the PHPSHE 1.6 userbank parameter. | Mar 22, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-18486CRITICAL An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter. | Oct 18, 2018 | 9.8 | 30 | NO | NO |
CVE-2020-19165CRITICAL PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter. | Dec 11, 2020 | 9.8 | 29 | NO | NO |
CVE-2019-9626CRITICAL PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php. | Mar 7, 2019 | 9.8 | 29 | NO | NO |
CVE-2025-3553CRITICAL A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&act=del. The manipulat | Apr 14, 2025 | 9.8 | 27 | NO | NO |
CVE-2020-18020CRITICAL SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to th | Apr 28, 2021 | 9.8 | 25 | NO | NO |
CVE-2022-24132HIGH phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service. | Mar 30, 2022 | 7.5 | 24 | NO | NO |
CVE-2019-6708HIGH PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter. | Jan 23, 2019 | 7.2 | 24 | NO | NO |
CVE-2018-18485HIGH An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This ca | Oct 18, 2018 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpshe.
Media articles that mention a CVE ID that affects a product developed by Phpshe — matched by CVE ID, not by vendor name.