MavenPackage

com.shopizer:shopizer

5 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 2.16.0 (Dec 27, 2020): affected by 5 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 5 · 1 critical, 2 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-36767Critical 10.0
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any…
Affected: through 2.16.0.
No fix released. The latest release, 2.16.0, is still affected.
CVE-2026-36766Medium 5.4
Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows…
Affected: through 2.16.0.
No fix released. The latest release, 2.16.0, is still affected.
CVE-2022-23059Medium 4.8
Shopizer - Stored XSS in Manage Images
Affected: from 2.0.2, fixed in 3.0.0.
No fix released. The advisory names 3.0.0 as the fix, which the registry doesn't have yet. The latest release, 2.16.0, is still affected.
CVE-2021-33561Unrated
A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML…
Affected: fixed in 2.17.0.
No fix released. The advisory names 2.17.0 as the fix, which the registry doesn't have yet. The latest release, 2.16.0, is still affected.
CVE-2021-33562Unrated
A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or…
Affected: fixed in 2.17.0.
No fix released. The advisory names 2.17.0 as the fix, which the registry doesn't have yet. The latest release, 2.16.0, is still affected.