Webasyst develops a focused line of e-commerce and web-application platforms, primarily Shop-Script, with vulnerabilities centered on application-layer input-handling weaknesses including cross-site scripting and SQL injection. Treat this as a compact vendor profile rather than a broad trend line; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webasyst over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-1462HIGH Directory traversal vulnerability in WebAsyst Shop-Script FREE has unknown impact and attack vectors via the sub parameter. | Apr 16, 2010 | 10.0 | 27 | NO | NO |
CVE-2006-5566MEDIUM CRLF injection vulnerability in premium/index.php in Shop-Script allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF seque | Oct 27, 2006 | 5.0 | 23 | NO | YES |
CVE-2010-4859HIGH SQL injection vulnerability in index.php in WebAsyst Shop-Script allows remote attackers to execute arbitrary SQL commands via the blog_id parameter in a news action. | Oct 5, 2011 | 7.5 | 22 | NO | NO |
CVE-2010-1463HIGH Multiple SQL injection vulnerabilities in WebAsyst Shop-Script FREE allow attackers to execute arbitrary SQL commands via the (1) add2cart, (2) c_id, (3) categoryID, (4) list_price | Apr 16, 2010 | 7.5 | 21 | NO | NO |
CVE-2007-1855HIGH Multiple PHP remote file inclusion vulnerabilities in smarty/smarty_class.php in Shop-Script FREE allow remote attackers to execute arbitrary PHP code via a URL in the (1) _smarty_ | Apr 3, 2007 | 7.5 | 21 | NO | NO |
CVE-2024-27517MEDIUM Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions. | Feb 29, 2024 | 5.4 | 16 | NO | NO |
CVE-2014-8377MEDIUM Cross-site scripting (XSS) vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new cont | Oct 21, 2014 | 4.3 | 14 | NO | NO |
CVE-2010-1464MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) cur | Apr 16, 2010 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webasyst.
Media articles that mention a CVE ID that affects a product developed by Webasyst — matched by CVE ID, not by vendor name.