Phpshop is a narrowly scoped e-commerce platform that has accumulated vulnerabilities primarily centered on web-application input handling and state management. The recurring weakness classes—cross-site scripting, SQL injection, and cross-site request forgery—are characteristic of server-side PHP applications where validation and encoding layers are weak, and the vendor's disclosures frequently acquire public exploit code. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpshop over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-4571HIGH Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the (1) module_id parameter in an admin/function_l | Jan 5, 2010 | 7.5 | 28 | NO | YES |
CVE-2008-0681MEDIUM SQL injection vulnerability in index.php in PHPShop 0.8.1 allows remote attackers to execute arbitrary SQL commands via the product_id parameter, as demonstrated by a shop/flypage | Feb 12, 2008 | 6.8 | 27 | NO | YES |
CVE-2004-2010HIGH PHP remote file inclusion vulnerability in index.php in phpShop 0.7.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the base_dir parameter to refer | Dec 31, 2004 | 7.5 | 26 | NO | NO |
CVE-2010-4836MEDIUM Cross-site scripting (XSS) vulnerability in register.html in PHPShop 2.1 EE and earlier allows remote attackers to inject arbitrary web script or HTML via the name_new parameter. | Sep 14, 2011 | 4.3 | 25 | NO | YES |
CVE-2011-1069MEDIUM PHPShop through 0.8.1 has XSS. | Feb 5, 2020 | 6.1 | 21 | NO | NO |
CVE-2009-4572MEDIUM Cross-site request forgery (CSRF) vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd functi | Jan 5, 2010 | 6.8 | 19 | NO | NO |
CVE-2009-4570MEDIUM Cross-site scripting (XSS) vulnerability in PhpShop 0.8.1 allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in an order/order_print action t | Jan 5, 2010 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpshop.
Media articles that mention a CVE ID that affects a product developed by Phpshop — matched by CVE ID, not by vendor name.