Read the docs

shopware

Records80All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high30CVSS 7.0–8.9

Exploited now

shopware records in CISA KEV

No shopware vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Shopware 67 records HIGH B2b Suite 1 record LOW Swagpaypal 1 record LOW

Records

80 records

TI-2023-01895 CVE-2023-2017 · GHSA-7v2v-9rm4-7m8f

Improper Control of Generation of Code in Twig Rendered Views in Shopware

Priority HIGH 73

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig envi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02066 Published 2023-04-17 Fixed in 6.4.20.1 CWE-1336
TI-2019-09582 CVE-2019-12799 · GHSA-rf8f-hqjv-986p

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can…

Priority HIGH 70

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiat…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54055 Published 2019-06-13 No fix listed CWE-502
TI-2025-07276 CVE-2025-7954 · GHSA-27gv-mg7w-mm34

Race Condition in Shopware Voucher Submission

Priority MEDIUM 60

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00419 Published 2025-08-06 No fix listed CWE-362
TI-2017-13531 CVE-2017-18357 · GHSA-6m27-7cqj-2mxw

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the…

Priority MEDIUM 51

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.27074 Published 2019-01-15 Fixed in 5.3.4 CWE-610
TI-2021-15583 CVE-2021-37708 · GHSA-xh55-2fqp-p775

Command injection in mail agent settings

Priority MEDIUM 47

Shopware is an open source eCommerce platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02359 Published 2021-08-16 Fixed in 6.4.3.1 CWE-77
TI-2026-71945 CVE-2026-104937 · GHSA-pfh5-g6h6-v95h

Stored cross-site scripting in Shopware exposes admin tokens

Priority MEDIUM 44

Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS).

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00593 Published 2026-10-13 No fix listed CWE-79
TI-2021-12379 CVE-2021-32711 · GHSA-2p89-5f22-8qvf

Leak of information via Store-API

Priority MEDIUM 42

Shopware is an open source eCommerce platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01359 Published 2021-06-24 Fixed in 6.3.5.1 CWE-200
TI-2023-08904 CVE-2023-22730 · GHSA-8r6h-m72v-38fg

Improper Input Validation of Clearance sale in cart

Priority MEDIUM 40

Shopware is an open source commerce platform based on Symfony Framework and Vue js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0069 Published 2023-01-17 Fixed in 6.4.18.1 CWE-20
Load more
Open these records in search →