Hikashop
by Hikashop
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-38044 | Cri | 0.64 | 9.8 | 0.01 | Aug 7, 2023 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection. | ||
| CVE-2025-22210 | Hig | 0.47 | 7.2 | 0.01 | Feb 25, 2025 | A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend. | ||
| CVE-2025-25225 | Med | 0.42 | 6.5 | 0.00 | Mar 15, 2025 | A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions. | ||
| CVE-2023-54364 | Med | 0.40 | 6.1 | 0.00 | Apr 9, 2026 | Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the… | ||
| CVE-2024-40746 | Med | 0.35 | 5.4 | 0.00 | Oct 21, 2024 | A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description… | ||
| CVE-2015-7344 | Med | 0.31 | 4.8 | 0.01 | Mar 9, 2020 | HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption]. |
- risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.
- risk 0.47cvss 7.2epss 0.01
A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
- risk 0.42cvss 6.5epss 0.00
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
- risk 0.40cvss 6.1epss 0.00
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the…
- risk 0.35cvss 5.4epss 0.00
A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description…
- risk 0.31cvss 4.8epss 0.01
HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].