{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-12T02:56:05.237","vulnerabilities":[{"cve":{"id":"CVE-2026-28213","sourceIdentifier":"security-advisories@github.com","published":"2026-02-26T23:16:35.770","lastModified":"2026-02-28T01:18:18.080","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."},{"lang":"es","value":"EverShop es una plataforma de comercio electrónico TypeScript-first. Versiones anteriores a la 2.1.1 tienen una vulnerabilidad en la funcionalidad de 'Olvidé mi contraseña'. Al especificar una dirección de correo electrónico objetivo, la respuesta de la API devuelve el token de restablecimiento de contraseña. Esto permite a un atacante tomar el control de la cuenta asociada. La versión 2.1.1 soluciona el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-640"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-640"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*","versionEndExcluding":"2.1.1","matchCriteriaId":"454D1A1C-4946-4C6C-A2D8-B07AEF27E3E2"}]}]}],"references":[{"url":"https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}