CVE-2026-25993Disclosure(evershop / evershop)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch evershop evershop systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

evershop CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd

Vendor / third-party advisories

https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

evershop

Threat summary

Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 3d ago at 2 mentions (2026-02-11); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

evershop

Products

evershop

Deep dive

Activity timeline6 mentions / 5d

Signal classification2 categories

Disclosure

466.7%

Patch

233.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-10	1	Disclosure1
2026-02-11	2	Patch2
2026-02-12	1	Disclosure1
2026-02-13	1	Disclosure1
2026-03-20	1	Disclosure1

Full discourse6 posts

OffSeq | Adversary Tactics for Cyber Resilience@offseq239d
Patch
🚨 CRITICAL: CVE-2026-25993 in EverShop (<2.1.1) enables unauthenticated SQL injection — risking eCommerce data and compliance. Patch ASAP! https://radar.offseq.com/threat/cve-2026-25993-cwe-89-improper-neutralization-of-s-6994a1ac #OffSeq #SQLInjection #eCommerceSecurity https://t.co/dwDzU7lD5R
Post summary
CVE-2026-25993 is a critical unauthenticated SQL injection flaw in EverShop (versions <2.1.1); users should apply the available patch immediately to mitigate the risk to eCommerce data.
0001054
268 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds240d
Disclosure
CVE-2026-25993 SQL Injection in EverShop E-Commerce Platform via Stored ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25993 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces a SQL injection vulnerability (CVE-2026-25993) in the EverShop e‑commerce platform and directs readers to a vulnerability details page for more information.
0001069
4.0K followersView on X
Komodo Cyber Security@Komodosec202d
Disclosure
#VulnerabilityReport #CVE202625993 CVE-2026-25993: Critical EverShop SQL Injection (CVSS 9.3) Exposes Stores https://securityonline.info/cve-2026-25993-critical-evershop-sql-injection-cvss-9-3-exposes-stores/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The post announces a critical SQL injection in EverShop (CVE-2026-25993) with a CVSS score of 9.3, but does not provide any PoC, exploit, or patch information.
0000040
1.5K followersView on X
CrowdCyber 🌐@CrowdCyber_Com238d
Disclosure
CVE-2026-25993: Critical EverShop SQL Injection (CVSS 9.3) Exposes Stores https://securityonline.info/cve-2026-25993-critical-evershop-sql-injection-cvss-9-3-exposes-stores/
Post summary
The text announces a new critical SQL injection vulnerability (CVE‑2026‑25993) in EverShop with a CVSS score of 9.3, but does not provide evidence of PoC, exploit code, active exploitation, or patch information.
0000049
298 followersView on X
Karma-X@Karma_X_Inc238d
Disclosure
CVE-2026-25993: Critical EverShop SQL Injection (CVSS 9.3) Exposes Stores https://securityonline.info/cve-2026-25993-critical-evershop-sql-injection-cvss-9-3-exposes-stores/
Post summary
A critical SQL injection flaw (CVE-2026-25993) affecting EverShop stores has been disclosed, with a CVSS score of 9.3. No PoC, exploit, patch, or active exploitation details are provided.
0000047
73 followersView on X
CCB Alert@CCBalert239d
Patch
Warning: CVE-2026-25993, a critical #SQL Injection vulnerability in #EverShop eCommerce platform could allow unauthenticated remote attackers to execute arbitrary SQL commands on the backend database. No user interaction required. Patched from v2.1.1 https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch
Post summary
The post warns of a critical SQL injection in EverShop eCommerce that lets unauthenticated remote attackers execute arbitrary SQL, but notes that the vulnerability is fixed in v2.1.1.
00000203
7.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	evershop	evershop	-	node.js	-

Explore more

Back to dashboard evershop CVEs evershop vulnerabilities

What researchers are saying

CVE-2026-25993

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

CVE-2026-25993 is a critical unauthenticated SQL injection flaw in EverShop (versions <2.1.1); users should apply the available patch immediately to mitigate the risk to eCommerce data.

Komodo Cyber Security[verified]@KomodosecDisclosure

The post announces a critical SQL injection in EverShop (CVE-2026-25993) with a CVSS score of 9.3, but does not provide any PoC, exploit, or patch information.

Karma-X[verified]@Karma_X_IncDisclosure

A critical SQL injection flaw (CVE-2026-25993) affecting EverShop stores has been disclosed, with a CVSS score of 9.3. No PoC, exploit, patch, or active exploitation details are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces a SQL injection vulnerability (CVE-2026-25993) in the EverShop e‑commerce platform and directs readers to a vulnerability details page for more information.

CrowdCyber 🌐@CrowdCyber_ComDisclosure

The text announces a new critical SQL injection vulnerability (CVE‑2026‑25993) in EverShop with a CVSS score of 9.3, but does not provide evidence of PoC, exploit code, active exploitation, or patch information.

CCB Alert@CCBalertPatch

The post warns of a critical SQL injection in EverShop eCommerce that lets unauthenticated remote attackers execute arbitrary SQL, but notes that the vulnerability is fixed in v2.1.1.