Vulnerabilities

TI-2026-24441 CVE-2026-31889 · GHSA-c4p7-rwrg-pf6p

Shopware has a potential take over of app credentials

MEDIUM 40

Shopware is an open commerce platform.

CVSS 3.1HIGH 8.9 Network No auth No interaction EPSS 0.00304 Published 2026-03-11 Fixed in 6.7.8.1, 6.6.10.15 CWE-290

TI-2026-24440 CVE-2026-31888 · GHSA-gqc5-xv7m-gcjq

Shopware has user enumeration via distinct error codes on Store API login endpoint

LOW 24

Shopware is an open commerce platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00253 Published 2026-03-11 Fixed in 6.7.8.1, 6.6.10.15 +1 CWE-204

TI-2026-24439 CVE-2026-31887 · GHSA-7vvp-j573-5584

Shopware unauthenticated data extraction possible through store-api.order endpoint

LOW 38

Shopware is an open commerce platform.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00272 Published 2026-03-11 Fixed in 6.7.8.1, 6.6.10.15 CWE-863

TI-2026-18931 CVE-2026-23498 · GHSA-7cw6-7h3h-v8pf

Shopware Improper Control of Generation of Code in Twig rendered views

LOW 34

Shopware is an open commerce platform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00442 Published 2026-01-14 Fixed in 6.7.6.1 CWE-94

TI-2025-41391 CVE-2025-67648 · GHSA-6w82-v552-wjw2

Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page

LOW 30

Shopware is an open commerce platform.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00188 Published 2025-12-10 Fixed in 6.6.10.10, 6.7.5.1 CWE-79

TI-2025-07276 CVE-2025-7954 · GHSA-27gv-mg7w-mm34

Race Condition in Shopware Voucher Submission

MEDIUM 60

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00419 Published 2025-08-06 No fix listed CWE-362

TI-2025-32365 CVE-2025-51541 · GHSA-mh52-5xcm-mhfr

A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00441 Published 2025-08-05 No fix listed CWE-79

TI-2025-20623 CVE-2025-27892 · GHSA-8g35-7rmw-7f59

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the…

HIGH 71

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.12929 Published 2025-04-15 Fixed in 6.7.0.0-rc2, 6.6.10.3 +1 CWE-89

TI-2025-23457 CVE-2025-32378 · GHSA-4h9w-7vfp-px8m

Shopware's default newsletter opt-in settings allow for mass sign-up abuse

LOW 30

Shopware is an open source e-commerce software platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00317 Published 2025-04-09 Fixed in 6.5.8.17, 6.6.10.3 +1 CWE-799

TI-2025-21489 CVE-2025-30150 · GHSA-hh7j-6x3q-f52h

Shopware 6 allows attackers to check for registered accounts through the store-api

LOW 25

Shopware 6 is an open commerce platform based on Symfony Framework and Vue.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00407 Published 2025-04-08 Fixed in 6.5.8.17, 6.6.10.3 +2 CWE-204

TI-2025-21490 CVE-2025-30151 · GHSA-cgfj-hj93-rmh2

Shopware allows Denial Of Service via password length

LOW 39

Shopware is an open commerce platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2025-04-08 Fixed in 6.5.8.17, 6.6.10.3 +1 CWE-20

TI-2024-28344 CVE-2024-42357 · GHSA-p6w9-r443-r752

Shopware vulnerable to blind SQL-injection in DAL aggregations

MEDIUM 49

Shopware is an open commerce platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00602 Published 2024-08-08 Fixed in 6.5.8.13, 6.6.5.1 CWE-89

TI-2024-28343 CVE-2024-42356 · GHSA-35jp-8cgg-p4wj

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

HIGH 71

Shopware is an open commerce platform.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00648 Published 2024-08-08 Fixed in 6.5.8.13, 6.6.5.1 CWE-1336

TI-2024-28342 CVE-2024-42355 · GHSA-27wp-jvhw-v4xp

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

MEDIUM 44

Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00863 Published 2024-08-08 Fixed in 6.5.8.13, 6.6.5.1 CWE-1336

TI-2024-28341 CVE-2024-42354 · GHSA-hhcq-ph6w-494g

Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

LOW 27

Shopware is an open commerce platform.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00429 Published 2024-08-08 Fixed in 6.5.8.13, 6.6.5.1 CWE-284

TI-2024-20811 CVE-2024-31447 · GHSA-5297-wrrp-rcj7

Shopware has Improper Session Handling in store-api

LOW 25

Shopware 6 is an open commerce platform based on Symfony Framework and Vue.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00499 Published 2024-04-08 Fixed in 6.5.8.8, 6.6.1.0 CWE-613

TI-2024-18522 CVE-2024-27917 · GHSA-c2f9-4jmm-v45m

Shopware's session is persistent in Cache for 404 pages

MEDIUM 40

Shopware is an open commerce platform based on Symfony Framework and Vue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00611 Published 2024-03-06 Fixed in 6.5.8.7 CWE-524

TI-2024-14980 CVE-2024-22406 · GHSA-qmp9-2xwj-m6m9

Blind SQL-injection in DAL aggregations in Shopware

MEDIUM 49

Shopware is an open headless commerce platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0064 Published 2024-01-16 Fixed in 6.5.7.4 CWE-89

TI-2024-14981 CVE-2024-22407 · GHSA-3867-jc5c-66qf

Broken Access Control order API in Shopware

LOW 29

Shopware is an open headless commerce platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.004 Published 2024-01-16 Fixed in 6.5.7.4 CWE-284

TI-2024-14982 CVE-2024-22408

Server-Side Request Forgery (SSRF) in Shopware Flow Builder

LOW 35

Shopware is an open headless commerce platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00366 Published 2024-01-16 Fixed in 6.5.7.4 CWE-918

TI-2023-16945 CVE-2023-34099 · GHSA-gh66-fp7j-98v5

Improper mail validation in Shopware

LOW 31

Shopware is an open source e-commerce software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00649 Published 2023-06-27 Fixed in 5.7.18 CWE-754

TI-2023-16944 CVE-2023-34098 · GHSA-q97c-2mh3-pgw9

Dependency configuration exposed in Shopware

LOW 31

Shopware is an open source e-commerce software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00611 Published 2023-06-27 Fixed in 5.7.18 CWE-200

TI-2022-23827 CVE-2022-48150 · GHSA-mj9r-fpv3-rgfx

Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.

LOW 28

Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00585 Published 2023-04-21 No fix listed CWE-79

TI-2023-01895 CVE-2023-2017 · GHSA-7v2v-9rm4-7m8f

Improper Control of Generation of Code in Twig Rendered Views in Shopware

HIGH 73

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig envi…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02066 Published 2023-04-17 Fixed in 6.4.20.1 CWE-1336

TI-2023-08907 CVE-2023-22733 · GHSA-7cp7-jfp6-jh4f

Improper Output Neutralization in Log Module in shopware

LOW 30

Shopware is an open source commerce platform based on Symfony Framework and Vue js.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00737 Published 2023-01-17 Fixed in 6.4.18.1 CWE-532

Vulnerabilities

Filters