Ecshop
Vendor:
First CVE: May 25, 2010 · Active for 16 years
15
Total CVEs
More Total CVEs than 93% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 78% of tracked products
8.3
Avg CVSS
Higher Avg CVSS than 75% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ecshop over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 25, 2010
16 years ago
Most Recent CVE
May 22, 2024
796 days ago
CVE Severity & Scoring
Ecshop15 CVEs
27%
40%
33%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network14 (93.3%)
Unknown1 (6.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (93.3%)
High0 (0.0%)
Unknown1 (6.7%)
User Interaction
None12 (80.0%)
Unknown1 (6.7%)
Required2 (13.3%)
Privileges Required
Low6 (40.0%)
High1 (6.7%)
None7 (46.7%)
Unknown1 (6.7%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41460HIGH ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information. | Jun 28, 2022 | 7.5 | 41 | NO | YES |
CVE-2020-22205CRITICAL SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. | Jun 16, 2021 | 9.8 | 31 | NO | NO |
CVE-2010-2042HIGH SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via the encode parameter. NOTE: some of these details are obtai | May 25, 2010 | 7.5 | 31 | NO | YES |
CVE-2021-43679CRITICAL ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php. | Dec 2, 2021 | 9.8 | 30 | NO | NO |
CVE-2023-0783CRITICAL A vulnerability was found in EcShop 4.1.5. It has been classified as critical. This affects an unknown part of the file /ecshop/admin/template.php of the component PHP File Handler | Feb 11, 2023 | 9.8 | 29 | NO | NO |
CVE-2020-22206CRITICAL SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. | Jun 16, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-22204CRITICAL SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. . | Jun 16, 2021 | 9.8 | 29 | NO | NO |
CVE-2023-1184HIGH A vulnerability, which was classified as problematic, has been found in ECshop up to 4.1.8. Affected by this issue is some unknown functionality of the file admin/database.php of t | Mar 6, 2023 | 8.8 | 27 | NO | NO |
CVE-2023-1185HIGH A vulnerability, which was classified as problematic, was found in ECshop up to 4.1.8. This affects an unknown part of the component New Product Handler. The manipulation leads to | Mar 6, 2023 | 8.8 | 26 | NO | NO |
CVE-2024-1530HIGH A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of the file /admin/view_sendlist.php. The ma | Feb 15, 2024 | 8.8 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
6.7% of CVEs· 97th percentile
ExploitDB
1 CVE
6.7% of CVEs· 86th percentile
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Ecshop
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.1.8 | 1 | 8.8 | 0.6% | 0 | 0 |
| 4.1.5 | 2 | 8.2 | 0.7% | 0 | 0 |
| 4.1.16 | 1 | 6.5 | 0.6% | 0 | 0 |
| 4.1.1 | 1 | 8.8 | 0.5% | 0 | 0 |
| 4.1.0 | 1 | 7.5 | 6.8% | 0 | 1 |
| 4.0 | 1 | 6.1 | 0.9% | 0 | 0 |
| 3.6 | 1 | 5.4 | 0.3% | 0 | 0 |
| 3.0 | 2 | 9.8 | 1.5% | 0 | 0 |
| 2.7.6 | 1 | 9.8 | 1.5% | 0 | 0 |
| 2.7.3 | 1 | 9.8 | 1.6% | 0 | 0 |
| 2.7.2 | 1 | 7.5 | 1.0% | 0 | 1 |