Shopex maintains a focused vulnerability footprint centered on its ECShop e-commerce platform, which has been widely deployed across merchant sites. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code; the exposure recurs consistently through application-layer weakness classes including SQL injection, unrestricted file upload, cross-site scripting, and improper authentication that are characteristic of web-facing commerce systems. Defenders should treat ECShop instances as a patching priority given the sensitive data they handle and the public availability of exploitation tooling; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Shopex over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41460HIGH ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information. | Jun 28, 2022 | 7.5 | 41 | NO | YES |
CVE-2020-22205CRITICAL SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. | Jun 16, 2021 | 9.8 | 31 | NO | NO |
CVE-2010-2042HIGH SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter. NOTE: some of these details are obtai | May 25, 2010 | 7.5 | 31 | NO | YES |
CVE-2021-43679CRITICAL ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php. | Dec 2, 2021 | 9.8 | 30 | NO | NO |
CVE-2023-0783CRITICAL A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler | Feb 11, 2023 | 9.8 | 29 | NO | NO |
CVE-2020-22206CRITICAL SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. | Jun 16, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-22204CRITICAL SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. . | Jun 16, 2021 | 9.8 | 29 | NO | NO |
CVE-2023-1184HIGH A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file admin/database.php of t | Mar 6, 2023 | 8.8 | 27 | NO | NO |
CVE-2023-1185HIGH A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New Product Handler. The manipulation leads to | Mar 6, 2023 | 8.8 | 26 | NO | NO |
CVE-2024-1530HIGH A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of the file /admin/view_sendlist.php. The ma | Feb 15, 2024 | 8.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Shopex.
Media articles that mention a CVE ID that affects a product developed by Shopex — matched by CVE ID, not by vendor name.