CVE-2017-16614: TP-Shop Tpshop

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the plugins/payment/weixin/lib/WxPay.tedatac.php fBill parameter.

Affected products

• TP-Shop Tpshop: version 2.0.5 only; version 2.0.6 only

Published 2018-03-30. Last modified 2026-06-17.