Cross-Origin Resource Sharing Vulnerability in Shopizer by Shopizer
CVE-2025-51605

8.1HIGH

Key Information:

Vendor

Shopizer

Status
Shopizer
Vendor
CVE Published:
22 August 2025

What is CVE-2025-51605?

An issue exists in Shopizer 3.2.7 where the server's CORS implementation improperly reflects the client-supplied Origin header directly into the Access-Control-Allow-Origin response header. This flaw lacks proper whitelist validation and exposes the server to risks where any malicious domain can execute authenticated cross-origin requests. Consequently, this vulnerability can lead to unauthorized access to sensitive information and responses from the server.

References

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.