{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.0"}],"component":"@evershop/evershop","cve_ids":["CVE-2025-12919"],"ecosystem":"npm","epss":0.00498,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-c73g-mx2w-cc93","id":"tcs_01M5KFJ0XJWPC4F6Y6NGXSX7F8","modified_at":"2025-12-12T16:01:43.417234Z","published_at":"2025-11-09T21:30:16Z","references":["https://osv.dev/vulnerability/GHSA-c73g-mx2w-cc93","https://nvd.nist.gov/vuln/detail/CVE-2025-12919","https://github.com/evershopcommerce/evershop","https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md","https://github.com/ictrun/Evershop-Order-leak/blob/main/README.md#attack-steps","https://vuldb.com/?ctiid.331639","https://vuldb.com/?id.331639","https://vuldb.com/?submit.680788"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-c73g-mx2w-cc93","url":"https://osv.dev/vulnerability/GHSA-c73g-mx2w-cc93"}],"summary":"EverShop is vulnerable to Unauthorized Order Information Access (IDOR)"}