CVE-2026-25993: Evershop

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

Affected products

• Evershop Evershop: up to and including 2.1.0

Published 2026-02-10. Last modified 2026-06-17.