Unknown MStore API vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20234
3. 20267

Newest CVEs

• CVE-2026-97219

  MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

  Unknown · MStore API

  Medium4.3
• CVE-2026-18234

  MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

  Unknown · MStore API

  Medium6.5
• CVE-2026-18233

  MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

  Unknown · MStore API

  Medium6.5
• CVE-2026-16041

  MStore API < 4.21.0 - Unauthenticated Product Review Creation

  Unknown · MStore API

  High7.5
• CVE-2026-16039

  MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

  Unknown · MStore API

  Medium6.5
• CVE-2026-16038

  MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

  Unknown · MStore API

  Critical9.1
• CVE-2026-16030

  MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

  Unknown · MStore API

  High8.1
• CVE-2023-3131

  MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update

  Unknown · MStore API

  Medium4.3
• CVE-2023-3209

  MStore API < 3.9.7 - Settings Update via CSRF

  Unknown · MStore API

  Low3.5
• CVE-2023-3077

  MStore API < 3.9.8 - Unauthenticated Blind SQLi

  Unknown · MStore API

  Critical9.8