CVE-2026-2165

detronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication

CVSS 6.9 MEDIUMEPSS 0.6%CWE-287 CWE-306

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.9EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

detronetdip · E-commerce

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/detronetdip/E-commerce/https://github.com/detronetdip/E-commerce/issues/23 https://github.com/Nixon-H/Unauthenticated-Admin-Account-Creation https://vuldb.com/?ctiid.344867 https://vuldb.com/?id.344867 https://vuldb.com/?submit.751857