shopware/core vulnerabilities (Packagist)
65 vulnerabilities.
-
shopware/corePackagist Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation 4.1 Medium -
shopware/corePackagist Shopware: Stored XSS via SVG file upload — no SVG sanitization 4.9 Medium -
shopware/corePackagist Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 4.3 Medium -
shopware/corePackagist Shopware: Admin API ACL Bypass in Order State Transition Endpoints 6.5 Medium -
shopware/corePackagist Shopware SSO referer trust leading to an arbitrary redirect target 4.3 Medium -
shopware/corePackagist Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames 3.7 Low -
shopware/corePackagist Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 6.5 Medium -
shopware/corePackagist Shopware: Admin Account Takeover via User Recovery Hash Exposure 6.8 Medium -
shopware/corePackagist Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 6.5 Medium -
shopware/corePackagist Shopware has a potential take over of app credentials 8.9 High -
shopware/corePackagist Shopware has user enumeration via distinct error codes on Store API login endpoint 5.3 Medium -
shopware/corePackagist Shopware unauthenticated data extraction possible through store-api.order endpoint 8.9 High -
shopware/corePackagist Shopware Improper Control of Generation of Code in Twig rendered views 7.2 High -
shopware/corePackagist Shopware 6's password recovery link does not expire after email change 5.0 Medium -
shopware/corePackagist Shopware Customer Orders can be canceled, even if refunds are disabled 4.3 Medium -
shopware/corePackagist Shopware exposes sensitive user information via CSV export mapping 4.9 Medium -
shopware/corePackagist Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice 2.7 Low -
shopware/corePackagist Shopware vulnerable to path traversal via Plugin upload 2.7 Low -
shopware/corePackagist Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually 5.3 Medium -
shopware/corePackagist Shopware: Reflective Cross Site-Scripting (XSS) in CMS components 8.8 High -
shopware/corePackagist Shopware's default newsletter opt-in settings allow for mass sign-up abuse 6.9 Medium -
shopware/corePackagist Shopware Broken ACL on Document retrieval to access other customers documents 4.0 Medium -
shopware/corePackagist Shopware Vulnerable to Blind SQL-injection in DAL aggregations 6.8 Medium -
shopware/corePackagist Shopware 6 allows attackers to check for registered accounts through the store-api 5.5 Medium -
shopware/corePackagist Shopware allows Denial Of Service via password length 7.5 High -
shopware/corePackagist Shopware vulnerable to blind SQL-injection in DAL aggregations 7.3 High -
shopware/corePackagist Shopware vulnerable to Server Side Template Injection in Twig using Context functions 8.3 High -
shopware/corePackagist Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag 8.3 High -
shopware/corePackagist Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api 5.3 Medium -
shopware/corePackagist Shopware has Improper Session Handling in store-api 5.3 Medium -
shopware/corePackagist Blind SQL-injection in DAL aggregations in Shopware 9.3 Critical -
shopware/corePackagist Broken Access Control order API in Shopware 4.9 Medium -
shopware/corePackagist Improper Control of Generation of Code in Twig Rendered Views in Shopware 8.8 High -
shopware/corePackagist Improper Output Neutralization in Log Module in shopware 2.7 Low -
shopware/corePackagist Insufficient Session Expiration in Administration in shopware 3.7 Low -
shopware/corePackagist Improper Control of Generation of Code in Twig rendered views in shopware 10.0 Critical -
shopware/corePackagist Improper Input Validation of Clearance sale in cart 5.3 Medium -
shopware/corePackagist Improper Input Newsletter subscription option validation in shopware 4.3 Medium -
shopware/corePackagist Improper Access Control in shopware 8.1 High -
shopware/corePackagist Server-Side Request Forgery (SSRF) in Shopware 7.2 High -
shopware/corePackagist Insufficient Session Expiration in shopware 2.6 Low -
shopware/corePackagist HTML injection possibility in voucher code form 6.1 Medium -
shopware/corePackagist HTTP caching is marking private HTTP headers as public 6.3 Medium -
shopware/corePackagist Incorrect Authentication in shopware 6.8 Medium -
shopware/corePackagist Webcache Poisoning in shopware/platform and shopware/core No score -
shopware/corePackagist Authenticated server-side request forgery in file upload via URL. 8.8 High -
shopware/corePackagist Cross-Site Scripting via SVG media files 8.0 High -
shopware/corePackagist Insecure direct object reference of log files of the Import/Export feature 6.5 Medium -
shopware/corePackagist Command injection in mail agent settings 8.8 High -
shopware/corePackagist Manipulation of product reviews via API 6.5 Medium - Show olderLoading…