Priority MEDIUM 44
Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS).
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00593 · Published 2026-10-13 · No fix listed CWE-79
Priority MEDIUM 53
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00275 · Published 2026-07-23 · Fixed in 6.7.10.1 CWE-601
Priority LOW 19
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 4.1· Network · High privileges · No interaction · EPSS 0.00366 · Published 2026-07-23 · Fixed in 6.6.10.18, 6.7.10.1 CWE-918
Priority LOW 30
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · No interaction · EPSS 0.00457 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-200
Priority LOW 29
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00389 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-862
Priority LOW 31
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00472 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-269
Priority LOW 20
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00414 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-639
Priority LOW 23
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00485 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-79
Priority LOW 31
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.00472 · Published 2026-07-17 · Fixed in 6.6.10.18, 6.7.10.1 CWE-862
Priority MEDIUM 51
Shopware is an open commerce platform.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00223 · Published 2026-06-10 · Fixed in 6.7.10.1, 6.6.10.18 CWE-208
Priority LOW 29
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00229 · Published 2026-03-12 · Fixed in 7.8.1, 6.10.15 CWE-200
Priority MEDIUM 40
Shopware is an open commerce platform.
CVSS 3.1HIGH 8.9· Network · No auth · No interaction · EPSS 0.00304 · Published 2026-03-11 · Fixed in 6.7.8.1, 6.6.10.15 CWE-290
Priority LOW 24
Shopware is an open commerce platform.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00253 · Published 2026-03-11 · Fixed in 6.7.8.1, 6.6.10.15 +1 CWE-204
Priority LOW 38
Shopware is an open commerce platform.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00272 · Published 2026-03-11 · Fixed in 6.7.8.1, 6.6.10.15 CWE-863
Priority LOW 34
Shopware is an open commerce platform.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00442 · Published 2026-01-14 · Fixed in 6.7.6.1 CWE-94
Priority LOW 30
Shopware is an open commerce platform.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00188 · Published 2025-12-10 · Fixed in 6.6.10.10, 6.7.5.1 CWE-79
Priority MEDIUM 60
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00419 · Published 2025-08-06 · No fix listed CWE-362
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00441 · Published 2025-08-05 · No fix listed CWE-79
Priority HIGH 71
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.
CVSS 3.1MEDIUM 6.8· Network · Low privileges · User interaction · EPSS 0.12929 · Published 2025-04-15 · Fixed in 6.7.0.0-rc2, 6.6.10.3 +1 CWE-89
Priority LOW 30
Shopware is an open source e-commerce software platform.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00317 · Published 2025-04-09 · Fixed in 6.5.8.17, 6.6.10.3 +1 CWE-799
Priority LOW 25
Shopware 6 is an open commerce platform based on Symfony Framework and Vue.
CVSS 4.0MEDIUM 5.5· Network · No auth · No interaction · EPSS 0.00407 · Published 2025-04-08 · Fixed in 6.5.8.17, 6.6.10.3 +2 CWE-204
Priority LOW 39
Shopware is an open commerce platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00425 · Published 2025-04-08 · Fixed in 6.5.8.17, 6.6.10.3 +1 CWE-20
Priority MEDIUM 49
Shopware is an open commerce platform.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00602 · Published 2024-08-08 · Fixed in 6.5.8.13, 6.6.5.1 CWE-89
Priority HIGH 71
Shopware is an open commerce platform.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00648 · Published 2024-08-08 · Fixed in 6.5.8.13, 6.6.5.1 CWE-1336
Priority MEDIUM 44
Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00863 · Published 2024-08-08 · Fixed in 6.5.8.13, 6.6.5.1 CWE-1336
Load more
THREATIST.IORead the docs