Shopware vulnerabilities

Products

• Shopware 77
• Platform 33
• Core 3

Newest

• shopware CVE-2026-104937 CVE-2026-104937 8.1 HighOctober 13, 2026
• runzero platform, shopware +1 more Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation CVE-2026-48013 Fix available 4.1 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Stored XSS via SVG file upload — no SVG sanitization CVE-2026-48015 Fix available 4.9 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment CVE-2026-48016 Fix available 4.3 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin API ACL Bypass in Order State Transition Endpoints CVE-2026-48014 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware SSO referer trust leading to an arbitrary redirect target CVE-2026-48012 Fix available 4.3 MediumJune 4, 2026
• shopware Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames CVE-2026-48011 Fix available 3.7 LowJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts CVE-2026-48010 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin Account Takeover via User Recovery Hash Exposure CVE-2026-48009 Fix available 6.8 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass CVE-2026-48008 Fix available 6.5 MediumJune 4, 2026
• shopware commercial shopware/commercial: `/api/_info/config` route exposes information about licenses CVE-2026-32142 5.3 MediumMarch 12, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has a potential take over of app credentials CVE-2026-31889 Fix available 8.9 HighMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888 Fix available 5.3 MediumMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware unauthenticated data extraction possible through store-api.order endpoint CVE-2026-31887 Fix available 8.9 HighMarch 11, 2026
• shopware Shopware Improper Control of Generation of Code in Twig rendered views CVE-2026-23498 Public exploitFix available 7.2 HighJanuary 14, 2026
• shopware Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page CVE-2025-67648 Fix available 7.1 HighDecember 9, 2025
• shopware Race Condition in Shopware Voucher Submission CVE-2025-7954 6.0 MediumAugust 6, 2025
• shopware A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface... CVE-2025-51541 6.1 MediumAugust 5, 2025
• shopware Shopware's default newsletter opt-in settings allow for mass sign-up abuse CVE-2025-32378 Fix available 6.9 MediumApril 9, 2025
• shopware Shopware Vulnerable to Blind SQL-injection in DAL aggregations CVE-2025-27892 Fix available EPSS 12.9% 6.8 MediumApril 8, 2025
• shopware Shopware 6 allows attackers to check for registered accounts through the store-api CVE-2025-30150 Fix available 5.5 MediumApril 8, 2025
• shopware Shopware allows Denial Of Service via password length CVE-2025-30151 Fix available 7.5 HighApril 8, 2025
• shopware Shopware vulnerable to blind SQL-injection in DAL aggregations CVE-2024-42357 Fix available 7.3 HighAugust 8, 2024
• shopware Shopware vulnerable to Server Side Template Injection in Twig using Context functions CVE-2024-42356 Fix available 8.3 HighAugust 8, 2024
• shopware Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag CVE-2024-42355 Fix available 8.3 HighAugust 8, 2024
• shopware Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api CVE-2024-42354 Fix available 5.3 MediumAugust 8, 2024
• shopware Shopware has Improper Session Handling in store-api CVE-2024-31447 Fix available 5.3 MediumApril 8, 2024
• shopware Shopware's session is persistent in Cache for 404 pages CVE-2024-27917 Fix available 7.5 HighMarch 6, 2024
• shopware Blind SQL-injection in DAL aggregations in Shopware CVE-2024-22406 Fix available 9.3 CriticalJanuary 16, 2024
• shopware Broken Access Control order API in Shopware CVE-2024-22407 Fix available 4.9 MediumJanuary 16, 2024
• shopware Server-Side Request Forgery (SSRF) in Shopware Flow Builder CVE-2024-22408 7.6 HighJanuary 16, 2024
• shopware Improper mail validation in Shopware CVE-2023-34099 Fix available 5.3 MediumJune 27, 2023
• shopware Dependency configuration exposed in Shopware CVE-2023-34098 Fix available 5.3 MediumJune 27, 2023
• shopware Shopware vulnerable to cross-site scripting (XSS) CVE-2022-48150 Public exploit 6.1 MediumApril 21, 2023
• shopware, shopware ag 6 +1 more Improper Control of Generation of Code in Twig Rendered Views in Shopware CVE-2023-2017 Fix available 8.8 HighApril 17, 2023
• shopware swagpaypal SwagPayPal payment not sent to PayPal correctly CVE-2023-23941 Fix available 7.5 HighFebruary 3, 2023
• runzero platform, shopware +1 more Improper Output Neutralization in Log Module in shopware CVE-2023-22733 Fix available 2.7 LowJanuary 17, 2023
• runzero platform, shopware +1 more Insufficient Session Expiration in Administration in shopware CVE-2023-22732 Fix available 3.7 LowJanuary 17, 2023
• runzero platform, shopware +1 more Improper Control of Generation of Code in Twig rendered views in shopware CVE-2023-22731 Fix available 10.0 CriticalJanuary 17, 2023
• runzero platform, shopware +1 more Improper Input Validation of Clearance sale in cart CVE-2023-22730 Fix available 5.3 MediumJanuary 17, 2023
• runzero platform, shopware +1 more Improper Input Newsletter subscription option validation in shopware CVE-2023-22734 Fix available 4.3 MediumJanuary 17, 2023
• shopware Acess control list bypassed via crafted specific URLs CVE-2022-36102 Fix available 6.3 MediumSeptember 12, 2022
• shopware Sensitive data in backend customer module CVE-2022-36101 Fix available 5.4 MediumSeptember 12, 2022
• shopware Persistent cross site scripting in customer module in Shopware CVE-2022-31148 Fix available 5.4 MediumJuly 27, 2022
• shopware Authenticated Stored XSS in Shopware Administration CVE-2022-31057 Fix available 6.5 MediumJune 22, 2022
• shopware Multiple valid tokens for password reset in Shopware CVE-2022-24892 Fix available 6.4 MediumApril 28, 2022
• shopware Malfunction of Cross-Site Request Forgery token validation CVE-2022-24879 Fix available 7.5 HighApril 28, 2022
• shopware Non-Stored Cross-site Scripting in Shopware storefront CVE-2022-24873 Fix available 5.4 MediumApril 28, 2022
• runzero platform, shopware +1 more Improper Access Control in shopware CVE-2022-24872 Fix available 8.1 HighApril 20, 2022
• runzero platform, shopware +1 more Server-Side Request Forgery (SSRF) in Shopware CVE-2022-24871 Fix available 7.2 HighApril 20, 2022
• Show olderLoading…