CVE-2025-12919
1 advisory.
npm/@evershop/evershop CVE-2025-12919: low 3.7, EPSS 0.50%
EverShop is vulnerable to Unauthorized Order Information Access (IDOR)
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-c73g-mx2w-cc93
- https://nvd.nist.gov/vuln/detail/CVE-2025-12919
- https://github.com/evershopcommerce/evershop
- https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md
- https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps
- https://vuldb.com/?ctiid.331639
- https://vuldb.com/?id.331639
- https://vuldb.com/?submit.680788
CVE-2025-12919 · published · modified · JSON