ShipStation offers a shipping and order-management platform primarily serving e-commerce businesses, where its vulnerability profile centers on the core product and reflects access-control and authorization gaps. The recurring weakness patterns—including missing authorization checks and cases where vulnerability details remain insufficiently characterized—point to potential gaps in permission enforcement across the platform's functionality. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Shipstation over time
Signals from CVEs in this vendor scope (2 CVEs).
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8889HIGH The ShipStation.com plugin 1.0 for CS-Cart allows remote attackers to obtain sensitive information (via action=export) because a typo results in a successful comparison of a blank | Mar 28, 2023 | 7.5 | 24 | NO | NO |
The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endp | Apr 11, 2023 | 3.7 | 17 | NO | NO |
Signals from CVEs in this vendor scope (2 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Shipstation.
Media articles that mention a CVE ID that affects a product developed by Shipstation — matched by CVE ID, not by vendor name.