After changing the storefront password, the preview link is still valid Analysed #1370749 Valid Access Control Low 2022-04-21 – 16 Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk` Analysed #1439355 Valid Access Control Low 2022-07-12 – 16 Open redirect using checkout_url Analysed #159522 Valid Open Redirect – 2016-09-01 – 17 Open CouchDB on experiments.ec2.shopify.com:5984 Analysed #159536 Valid No weakness recorded – 2016-09-01 – 17 HTML injection in https://interviewing.shopify.com/index.php?candidate= Analysed #601192 Valid Injection and Smuggling Low 2019-07-04 – 17 Clickjacking in [exchangemarketplace.com] Analysed #658217 Valid Misconfiguration and Insecure Design Low 2019-09-18 – 17 Open Redirect - www.shopify.com Analysed #905737 Valid Open Redirect Low 2020-07-14 – 17 Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler Analysed #1081167 Valid Cross-site Scripting Medium 2022-12-01 $1,600 17 Open Redirect on Login Page of Stocky App Analysed #1087189 Valid Open Redirect Medium 2021-02-11 – 17 [h1-2102] Partner's team member with no permission can retrieve services financial data Analysed #1091380 Valid Access Control Medium 2021-04-08 – 17 Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass. Analysed #1262434 Valid Access Control Low 2022-07-11 $500 17 [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails Analysed #1400309 Valid Cross-Site Request Forgery None 2022-04-16 – 17 Twitter Disconnect CSRF Analysed #111216 Valid Cross-Site Request Forgery – 2016-02-01 – 18 Publicly Accessible Datadog link Analysed #345152 Valid Information Disclosure None 2018-06-15 – 18 Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C Analysed #351519 Valid Access Control Low 2018-06-15 $500 18 PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard Analysed #415622 Valid Information Disclosure Low 2018-11-08 $500 18 Staff with no permissions could possibly list and accept billing promotions Analysed #1044869 Valid Access Control Low 2021-04-08 $600 18 [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname Analysed #1083922 Valid Information Disclosure Medium 2022-02-10 – 18 Ability to add address without being an admin or staff in the store via wholesale store Analysed #1279322 Valid No weakness recorded Low 2021-12-03 $500 18 Self XSS in https://linkpop.com/dashboard/admin Analysed #1591403 Valid Cross-site Scripting Low 2022-10-13 – 18 Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template #3697491 Informative Cryptography None 2026-06-01 – 18 Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure ) Analysed #154405 Valid Authentication – 2018-12-06 – 19 Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor Analysed #165046 Valid Open Redirect – 2016-09-22 – 19 Staff Member can Get POS Access Without User Interaction Analysed #1018094 Valid No weakness recorded Medium 2020-11-19 – 19 Domain Takeover at 3hopify.media Analysed #1344982 Valid Access Control None 2021-10-21 – 19 Attacker is able to query Github repositories of arbitrary Shopify Hydrogen Users Analysed #1692788 Valid Access Control Low 2023-03-09 $900 19 HTTP-Response-Splitting on v.shopify.com Analysed #106427 Valid No weakness recorded – 2016-01-17 $500 20 https://windsor.shopify.com/ takeover Analysed #150374 Valid Open Redirect – 2016-07-18 – 20 Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181 Analysed #154369 Valid Authentication – 2016-08-08 $1,000 20 Access to Private Photos of Apps in App section(IDOR) Analysed #318751 Valid Insecure Direct Object Reference Medium 2018-03-05 – 20 Unpublished Product Images can be disclosed Analysed #534554 Valid Access Control Low 2019-06-12 $500 20 Inject page in admin panel via Shopify.API.pushState [New Payload] Analysed #883867 Valid Cross-site Scripting Low 2020-12-27 $500 20 Store Deletion or Sell without authentication Analysed #1087382 Valid Authentication Low 2021-10-21 – 20 Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes Endpoints Analysed #1115139 Valid Server-Side Request Forgery Low 2021-12-02 – 20 XSS on manually entering Postal codes Analysed #190951 Valid Cross-site Scripting Medium 2016-12-17 $500 21 H1514 Stored XSS in Return Magic App portal content Analysed #420459 Valid Cross-site Scripting Medium 2019-11-08 – 21 H1514 Stored XSS on Wholesale sales channel allows cross-organization data leakage Analysed #423454 Valid Cross-site Scripting Medium 2019-11-01 – 21 Password reset link not expired at Stocky App Analysed #898841 Valid Access Control – 2020-08-18 – 21 XSS / SELF XSS Analysed #906201 Valid Cross-site Scripting Low 2020-09-14 – 21 Ability to publish a paid theme without purchasing it. Analysed #927567 Valid Access Control Low 2020-08-27 $2,000 21 staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission Analysed #1102652 Valid Access Control Low 2022-02-09 – 21 staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission Analysed #1102660 Valid Access Control Low 2022-02-09 – 21 Disconnecting an external login provider does not revoke session Analysed #1547684 Valid Authentication Medium 2022-12-01 $1,600 21 Information disclosure ( Google Sales Channel ) Analysed #1584718 Valid No weakness recorded – 2022-07-17 $500 21 Order Creation Webhooks can be edited/deleted by STAFF with `Settings` only permission Analysed #431633 Valid Access Control Low 2019-05-11 $500 22 Ability to potentially hit internal NGINX locations on *.myshopify.com by making use of the `X-Accel-Redirect` header via a configured App Proxy Analysed #1027873 Valid No weakness recorded None 2021-02-11 – 22 [h1-2102] HTML injection in packing slips can lead to physical theft Analysed #1087122 Valid Cross-site Scripting Low 2022-07-11 $900 22 Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly Analysed #165309 Valid No weakness recorded – 2016-09-06 – 23 Admin bar: Incomplete message origin validation results in XSS Analysed #387544 Valid Cross-site Scripting Medium 2018-11-07 – 23 H1514 CSRF in Domain transfer allows adding your domain to other user's account Analysed #416978 Valid Cross-Site Request Forgery High 2020-03-30 – 23