← 返回地图破甲

浏览报告

仅含 CVE

467 份报告 · 本页赏金 $21,100 · 清除筛选

Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata身份认证Shopify低危$3,1002026-11-03 Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template密码学缺陷Shopify低危—2026-06-01 mruby-engine: UAF in MRubyEngine#initialize enables local RCE其他弱点Shopify低危—2026-04-24 admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed信息泄露Shopify低危—2026-07-03 Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)身份认证Shopify低危—2025-09-04 GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)信息泄露Shopify低危—2025-09-17 Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification访问控制Shopify低危—2025-05-15 Exposure of shopify employee summit page allows anonymous user to place orders for free books业务逻辑Shopify低危—2024-07-29 Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering跨站脚本Shopify低危$1,6002026-06-18 HTTP Response Header Injection in shopify/pitchfork + Rack 3注入与走私Shopify低危$8002025-03-27 IDOR on GraphQL queries BillingDocumentDownload and BillDetails不安全的直接对象引用Shopify低危$5,0002024-02-08 Reflected XSS on help.shopify.com跨站脚本Shopify低危$5002024-01-25 URL Path Manipulation Enables Cache Poisoning of Amazon Affiliate Products in Shopify Linkpop注入与走私Shopify低危$5002025-08-14 Non-store owners can transfer Shopify-managed domain to another domain provider访问控制Shopify低危—2024-01-17 Reflected XSS In Marketing Reports Page On *.myshopify.com/admin跨站脚本Shopify低危—2025-04-15 URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution访问控制Shopify低危—2025-09-17 Shop App - Attacker is able to intercept authorization code during authentication (OAuth) and is able to get access to Microsoft Outlook email account身份认证Shopify低危$9002023-03-02 XSS in www.shopify.com/markets?utm_source=跨站脚本Shopify低危—2022-10-18 DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com注入与走私Shopify低危$3,8002025-06-04 Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users访问控制Shopify低危$9002023-03-09 Subdomain Takeover at course.oberlo.com访问控制Shopify低危—2022-12-01 Account Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email Verification身份认证Shopify低危$8002025-03-11 Cross-site scripting on api.collabs.shopify.com跨站脚本Shopify低危$1,6002022-10-13 Stored XSS in Dovetale by application of creator跨站脚本Shopify低危$1,6002022-11-29 store internal email disclosed through shopify-data-exporter信息泄露Shopify低危—2022-09-15