Search results

SSRF: webhook subscription issues an outbound request to a caller-controlled URL with no destination validation

Status: Open.

#999 In dotnet/eShop;

· luuhung1217 opened on Jun 13, 2026

Insecure file-serving pattern: GetItemPictureById allows path traversal / arbitrary file read via `PictureFileName'

Status: Open.

#998 In dotnet/eShop;

· luuhung1217 opened on Jun 13, 2026

Catalog API admin mutation endpoints have no authentication - unauthenticated item creation, update, and deletion

Status: Open.

#997 In dotnet/eShop;

· geo-chen opened on Jun 13, 2026

Ordering API cross-user IDOR - any authenticated user can read, cancel, or ship another user's orders

Status: Open.

#996 In dotnet/eShop;

· geo-chen opened on Jun 13, 2026

Update to latest Asp.Versioning package versions

Status: Open.

#989 In dotnet/eShop;

· eerhardt opened on May 12, 2026

Credit Card Numbers are still an issue

Status: Open.

#979 In dotnet/eShop;

· robconery opened on Apr 16, 2026

Eshop

Status: Open.

#977 In dotnet/eShop;

· AliTahsin opened on Mar 18, 2026

eshop

Status: Open.

#976 In dotnet/eShop;

· AliTahsin opened on Mar 18, 2026

Prerequisites installation docs are broken

Status: Open.

#973 In dotnet/eShop;

· antonfirsov opened on Mar 7, 2026

AddNewOrder in Ordering.FunctionalTests is not properly tested

Status: Open.

#943 In dotnet/eShop;

· mwakayama opened on Dec 23, 2025

Referential integrity bugs related to catalog, basket, and order

Status: Open.

#920 In dotnet/eShop;

· mafaldacf opened on Nov 26, 2025

Build fails for multi-target MAUI ClientApp due to inconsistent gRPC codegen for basket.proto — propose adding a shared GrpcClients project to centralize generated client types

Status: Open.

#919 In dotnet/eShop;

· github4mathews opened on Nov 24, 2025