PT-2026-7418 · Evershop · Evershop

Odgrso · Published 2026-02-10 · Updated 2026-03-20 · CVE-2026-25993

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.1.1

Description EverShop is a TypeScript-first eCommerce platform susceptible to a second-order SQL injection. During category update and deletion event handling, the application incorporates values from the url key—obtained from the database—into SQL statements using string concatenation and the execute() function. If a malicious string is stored in the url key, subsequent event processing can modify and execute the SQL statement, resulting in a second-order SQL injection. The vulnerable code utilizes the / and request path derived from the url key.

Recommendations Versions prior to 2.1.1 should be updated to version 2.1.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25993

GHSA-3H84-9RHC-J2CH

Affected Products

Evershop

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25993.json · Exploit
• https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25993 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25993 · Vendor Advisory
• http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd · Patch
• https://twitter.com/CrowdCyber_Com/status/2022121333857861880 · Twitter Post
• https://twitter.com/CCBalert/status/2021622410466726250 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021370432075571563 · Twitter Post
• https://t.me/CVEtracker/44319 · Telegram Post
• https://twitter.com/Komodosec/status/2035055168027599072 · Twitter Post
• https://t.me/pentestingnews/73081 · Telegram Post
• https://twitter.com/offseq/status/2021441615701626951 · Twitter Post