Smartstore operates a modestly represented e-commerce platform whose vulnerability profile skews strongly toward critical-severity outcomes across its core products. The exposure recurs through authentication and access-control weaknesses—including improper authentication, missing authentication for critical functions, cross-site request forgery, and path traversal—that are characteristic of web application attack surfaces where administrative and transaction integrity are at stake. Vulnerabilities affecting this vendor tend to acquire public exploit tooling; live severity, exploitation, and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Smartstore over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-32608CRITICAL An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/Boards/Partials/_ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum po | May 12, 2021 | 9.8 | 48 | NO | NO |
CVE-2021-32607CRITICAL An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message. | May 12, 2021 | 9.8 | 47 | NO | NO |
CVE-2020-36365MEDIUM Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. | May 19, 2021 | 6.1 | 30 | NO | YES |
CVE-2020-36364CRITICAL An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the Im | May 19, 2021 | 9.1 | 29 | NO | NO |
CVE-2020-27996HIGH An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.CustomProperties situat | Oct 29, 2020 | 8.8 | 28 | NO | NO |
CVE-2020-15243CRITICAL Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have installed and activa | Oct 8, 2020 | 9.8 | 24 | NO | NO |
CVE-2020-27997HIGH An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to cre | Feb 19, 2021 | 8.8 | 22 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Smartstore.
Media articles that mention a CVE ID that affects a product developed by Smartstore — matched by CVE ID, not by vendor name.