CVE-2025-5108 | Medium | 6.3 | 2025-05-23 | A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Pay… |
CVE-2025-28094 | Medium | 6.5 | 2025-03-28 | shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. |
CVE-2025-28093 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. |
CVE-2025-28092 | Medium | 6.3 | 2025-03-28 | ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. |
CVE-2025-26325 | Critical | 9.8 | 2025-02-27 | ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. |
CVE-2025-1611 | Medium | 4.7 | 2025-02-24 | A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService… |
CVE-2024-44682 | Medium | 6.1 | 2024-08-30 | ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters. |
CVE-2024-6524 | Medium | 5.5 | 2024-07-05 | A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file exten… |
CVE-2021-41938 | High | 7.2 | 2022-05-19 | An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations. |
CVE-2022-28056 | Critical | 9.8 | 2022-05-02 | ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php. |
CVE-2020-26008 | High | 7.8 | 2022-03-20 | The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability which allows attacke… |
CVE-2020-26007 | High | 7.8 | 2022-03-20 | An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploading a crafted PHP fil… |
CVE-2020-19778 | Critical | 9.8 | 2021-04-14 | Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the parameter "user_id" in the… |
CVE-2021-27817 | Critical | 9.8 | 2021-03-15 | A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is upload… |
CVE-2020-24220 | High | 8.8 | 2020-08-17 | ShopXO v1.8.1 has a command execution vulnerability. Attackers can use this vulnerability to execute arbitrary commands and gain control of the server. |
CVE-2019-5887 | High | 7.5 | 2019-01-10 | An issue was discovered in ShopXO 1.2.0. In the UnlinkDir method of the FileUtil.php file, the input parameters are not checked, resulting in input mishandling… |
CVE-2019-5886 | Critical | 9.8 | 2019-01-10 | An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows… |