Shopware Platform vulnerabilities

• runzero platform, shopware +1 more Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation CVE-2026-48013 Fix available 4.1 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Stored XSS via SVG file upload — no SVG sanitization CVE-2026-48015 Fix available 4.9 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment CVE-2026-48016 Fix available 4.3 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin API ACL Bypass in Order State Transition Endpoints CVE-2026-48014 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware SSO referer trust leading to an arbitrary redirect target CVE-2026-48012 Fix available 4.3 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts CVE-2026-48010 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin Account Takeover via User Recovery Hash Exposure CVE-2026-48009 Fix available 6.8 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass CVE-2026-48008 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has a potential take over of app credentials CVE-2026-31889 Fix available 8.9 HighMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888 Fix available 5.3 MediumMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware unauthenticated data extraction possible through store-api.order endpoint CVE-2026-31887 Fix available 8.9 HighMarch 11, 2026
• runzero platform, shopware +1 more Improper Output Neutralization in Log Module in shopware CVE-2023-22733 Fix available 2.7 LowJanuary 17, 2023
• runzero platform, shopware +1 more Insufficient Session Expiration in Administration in shopware CVE-2023-22732 Fix available 3.7 LowJanuary 17, 2023
• runzero platform, shopware +1 more Improper Control of Generation of Code in Twig rendered views in shopware CVE-2023-22731 Fix available 10.0 CriticalJanuary 17, 2023
• runzero platform, shopware +1 more Improper Input Validation of Clearance sale in cart CVE-2023-22730 Fix available 5.3 MediumJanuary 17, 2023
• runzero platform, shopware +1 more Improper Input Newsletter subscription option validation in shopware CVE-2023-22734 Fix available 4.3 MediumJanuary 17, 2023
• runzero platform, shopware +1 more Improper Access Control in shopware CVE-2022-24872 Fix available 8.1 HighApril 20, 2022
• runzero platform, shopware +1 more Server-Side Request Forgery (SSRF) in Shopware CVE-2022-24871 Fix available 7.2 HighApril 20, 2022
• runzero platform, shopware +1 more Insufficient Session Expiration in shopware CVE-2022-24744 Fix available 2.6 LowMarch 9, 2022
• runzero platform, shopware +1 more Guest session is shared between customers in shopware CVE-2022-24745 Fix available 4.8 MediumMarch 9, 2022
• runzero platform, shopware +1 more HTML injection possibility in voucher code form CVE-2022-24746 Fix available 6.1 MediumMarch 9, 2022
• runzero platform, shopware +1 more HTTP caching is marking private HTTP headers as public CVE-2022-24747 Fix available 6.3 MediumMarch 9, 2022
• runzero platform, shopware +1 more Incorrect Authentication in shopware CVE-2022-24748 Fix available 6.8 MediumMarch 9, 2022
• runzero platform, shopware +1 more Authenticated server-side request forgery in file upload via URL. CVE-2021-37711 Fix available 8.8 HighAugust 16, 2021
• runzero platform, shopware +1 more Cross-Site Scripting via SVG media files CVE-2021-37710 Fix available 8.0 HighAugust 16, 2021
• runzero platform, shopware +1 more Insecure direct object reference of log files of the Import/Export feature CVE-2021-37709 Fix available 6.5 MediumAugust 16, 2021
• runzero platform, shopware +1 more Command injection in mail agent settings CVE-2021-37708 Fix available 8.8 HighAugust 16, 2021
• runzero platform, shopware +1 more Manipulation of product reviews via API CVE-2021-37707 Fix available 6.5 MediumAugust 16, 2021
• runzero platform, shopware +1 more Private files publicly accessible with Cloud Storage providers CVE-2021-32717 Fix available 7.5 HighJune 24, 2021
• runzero platform, shopware +1 more Internal hidden fields are visible on to many associations in admin api CVE-2021-32716 Fix available 4.4 MediumJune 24, 2021
• runzero platform, shopware +1 more Creation of order credits was not validated by acl in admin orders CVE-2021-32709 Fix available 4.9 MediumJune 24, 2021
• runzero platform, shopware +1 more Potential Session Hijacking in Shopware CVE-2021-32710 Fix available 5.9 MediumMarch 12, 2021
• runzero platform, shopware +1 more Leak of information via Store-API CVE-2021-32711 Fix available 9.1 CriticalFebruary 10, 2021