shopware/platform vulnerabilities (Packagist)
70 vulnerabilities.
-
shopware/platformPackagist Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation 4.1 Medium -
shopware/platformPackagist Shopware: Stored XSS via SVG file upload — no SVG sanitization 4.9 Medium -
shopware/platformPackagist Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 4.3 Medium -
shopware/platformPackagist Shopware: Admin API ACL Bypass in Order State Transition Endpoints 6.5 Medium -
shopware/platformPackagist Shopware SSO referer trust leading to an arbitrary redirect target 4.3 Medium -
shopware/platformPackagist Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames 3.7 Low -
shopware/platformPackagist Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 6.5 Medium -
shopware/platformPackagist Shopware: Admin Account Takeover via User Recovery Hash Exposure 6.8 Medium -
shopware/platformPackagist Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 6.5 Medium -
shopware/platformPackagist Shopware has a potential take over of app credentials 8.9 High -
shopware/platformPackagist Shopware has user enumeration via distinct error codes on Store API login endpoint 5.3 Medium -
shopware/platformPackagist Shopware unauthenticated data extraction possible through store-api.order endpoint 8.9 High -
shopware/platformPackagist Shopware Customer Orders can be canceled, even if refunds are disabled 4.3 Medium -
shopware/platformPackagist Shopware exposes sensitive user information via CSV export mapping 4.9 Medium -
shopware/platformPackagist Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice 2.7 Low -
shopware/platformPackagist Shopware vulnerable to path traversal via Plugin upload 2.7 Low -
shopware/platformPackagist Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually 5.3 Medium -
shopware/platformPackagist Race Condition in Shopware Voucher Submission 6.0 Medium -
shopware/platformPackagist Shopware's default newsletter opt-in settings allow for mass sign-up abuse 6.9 Medium -
shopware/platformPackagist Shopware Broken ACL on Document retrieval to access other customers documents 4.0 Medium -
shopware/platformPackagist Shopware Vulnerable to Blind SQL-injection in DAL aggregations 6.8 Medium -
shopware/platformPackagist Shopware 6 allows attackers to check for registered accounts through the store-api 5.5 Medium -
shopware/platformPackagist Shopware allows Denial Of Service via password length 7.5 High -
shopware/platformPackagist Shopware vulnerable to blind SQL-injection in DAL aggregations 7.3 High -
shopware/platformPackagist Shopware vulnerable to Server Side Template Injection in Twig using Context functions 8.3 High -
shopware/platformPackagist Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag 8.3 High -
shopware/platformPackagist Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api 5.3 Medium -
shopware/platformPackagist Shopware has Improper Session Handling in store-api 5.3 Medium -
shopware/platformPackagist Shopware's session is persistent in Cache for 404 pages 7.5 High -
shopware/platformPackagist Blind SQL-injection in DAL aggregations in Shopware 9.3 Critical -
shopware/platformPackagist Broken Access Control order API in Shopware 4.9 Medium -
shopware/platformPackagist Improper Control of Generation of Code in Twig Rendered Views in Shopware 8.8 High -
shopware/platformPackagist Improper Output Neutralization in Log Module in shopware 2.7 Low -
shopware/platformPackagist Insufficient Session Expiration in Administration in shopware 3.7 Low -
shopware/platformPackagist Improper Control of Generation of Code in Twig rendered views in shopware 10.0 Critical -
shopware/platformPackagist Improper Input Validation of Clearance sale in cart 5.3 Medium -
shopware/platformPackagist Improper Input Newsletter subscription option validation in shopware 4.3 Medium -
shopware/platformPackagist Improper Access Control in shopware 8.1 High -
shopware/platformPackagist Server-Side Request Forgery (SSRF) in Shopware 7.2 High -
shopware/platformPackagist Insufficient Session Expiration in shopware 2.6 Low -
shopware/platformPackagist Guest session is shared between customers in shopware 4.8 Medium -
shopware/platformPackagist HTML injection possibility in voucher code form 6.1 Medium -
shopware/platformPackagist HTTP caching is marking private HTTP headers as public 6.3 Medium -
shopware/platformPackagist Webcache Poisoning in shopware/platform and shopware/core No score -
shopware/platformPackagist Authenticated server-side request forgery in file upload via URL. 8.8 High -
shopware/platformPackagist Cross-Site Scripting via SVG media files 8.0 High -
shopware/platformPackagist Insecure direct object reference of log files of the Import/Export feature 6.5 Medium -
shopware/platformPackagist Command injection in mail agent settings 8.8 High -
shopware/platformPackagist Manipulation of product reviews via API 6.5 Medium -
shopware/platformPackagist non-admin users can create integration role with administrator role No score - Show olderLoading…