Threats affecting pkg:npm/evershop

EverShop versions from 1.2.2 up to but not including 2.2.1 have a missing authorization vulnerability in the customer address API. This flaw allows unauthenticated attackers who know customer and address UUIDs to add, modify, or delete other customers' saved shipping addresses via POST, PATCH, or DELETE requests to the /api/customers/:customer_id/addresses endpoint.

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.