SH
Product
shopware
77
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 28Medium 41Low 2
Watch
Add shopware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-42357 | 9.8 | Aug 8 | Shopware vulnerable to blind SQL-injection in DAL aggregations Affected: >= 6.6.0.0, <= 6.6.5.0; <= 6.5.8.12 |
| CVE-2024-42355 | 9.8 | Aug 8 | Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag Affected: <= 6.5.8.12; >= 6.6.0.0, <= 6.6.5.0 |
| CVE-2024-22406 | 9.8 | Jan 16 | Shopware is an open headless commerce platform Affected: before 6.5.7.4 |
| CVE-2023-22732 | 9.8 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2021-37708 | 9.8 | Aug 16 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.3.1 |
| CVE-2016-3109 | 9.8 | Apr 21 | The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code Affected: through 5.1.4 |
| CVE-2026-31889 | 8.9 | Mar 11 | Shopware has a potential take over of app credentials Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2023-2017 | 8.8 | Apr 17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows… Affected: 6.1.0 through 6.4.20.0; 6.5.0.0; 6.5.0.0; 6.5.0.0 |
| CVE-2023-22731 | 8.8 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2021-37711 | 8.8 | Aug 16 | Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL Affected: 6.1.0 before 6.4.3.1 |
| CVE-2020-13970 | 8.8 | Jul 28 | Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature Affected: before 6.2.3 |
| CVE-2019-12799 | 8.8 | Jun 13 | In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary… Affected: through 5.6.0 |
| CVE-2018-20713 | 8.8 | Jan 15 | Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404 Affected: before 5.4.3 |
| CVE-2026-104937 | 8.1 | Oct 13 | Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting… Affected: 6.7 |
| CVE-2025-7954 | 8.1 | Aug 6 | Race Condition in Shopware Voucher Submission Affected: 6.6.x; 6.7.x |
| CVE-2024-22408 | 8.1 | Jan 16 | Shopware is an open headless commerce platform Affected: before 6.5.7.4 |
| CVE-2022-24872 | 8.1 | Apr 20 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: before 6.4.10.1 |
| CVE-2022-21652 | 8.1 | Jan 5 | Shopware is an open source e-commerce software platform Affected: 5.7.3 before 5.7.7 |
| CVE-2026-31887 | 7.5 | Mar 11 | Shopware unauthenticated data extraction possible through store-api.order endpoint Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2025-30151 | 7.5 | Apr 8 | Shopware allows Denial Of Service via password length Affected: < 6.5.8.17; >= 6.6.0.0, < 6.6.10.3; >= 6.7.0.0-rc1, < 6.7.0.0-rc2 |
| CVE-2024-27917 | 7.5 | Mar 6 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: 6.5.8.0 before 6.5.8.7 |
| CVE-2023-22734 | 7.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2023-22730 | 7.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2022-24892 | 7.5 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.0.4 before 5.7.9 |
| CVE-2022-24879 | 7.5 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.2.0 before 5.7.9 |
| CVE-2022-24748 | 7.5 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-37707 | 7.5 | Aug 16 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.3.1 |
| CVE-2021-32717 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.1.1 |
| CVE-2021-32711 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.3.5.1 |
| CVE-2021-32710 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.3.5.2 |
| CVE-2020-13997 | 7.5 | Jul 28 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled Affected: before 6.2.3 |
| CVE-2026-23498 | 7.2 | Jan 14 | Shopware Improper Control of Generation of Code in Twig rendered views Affected: >= 6.7.0.0, < 6.7.6.1 |
| CVE-2024-42356 | 7.2 | Aug 8 | Shopware vulnerable to Server Side Template Injection in Twig using Context functions Affected: <= 6.5.8.12; >= 6.6.0.0, <= 6.6.5.0 |
| CVE-2022-36102 | 7.2 | Sep 12 | Shopware is an open source e-commerce software Affected: 5.0.0 before 5.7.15 |
| CVE-2026-48009 | 6.8 | Jul 17 | Shopware: Admin Account Takeover via User Recovery Hash Exposure Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2025-27892 | 6.8 | Apr 15 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint Affected: before 6.5.8.17; 6.6.0.0 before 6.6.10.3; 6.7.0.0 |
| CVE-2026-48014 | 6.5 | Jul 17 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48010 | 6.5 | Jul 17 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48008 | 6.5 | Jul 17 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2024-22407 | 6.5 | Jan 16 | Shopware is an open headless commerce platform Affected: before 6.5.7.4 |
| CVE-2023-22733 | 6.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2022-24745 | 6.5 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-37709 | 6.5 | Aug 16 | Shopware is an open source eCommerce platform Affected: before 6.4.3.1 |
| CVE-2017-18357 | 6.5 | Jan 15 | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller,… Affected: before 5.3.4 |
| CVE-2025-67648 | 6.1 | Dec 10 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page Affected: >= 6.4.6.0, < 6.6.10.10; >= 6.7.0.0, < 6.7.5.1 |
| CVE-2025-51541 | 6.1 | Aug 5 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/ Affected: 6.1.0 before 6.2.3 |
| CVE-2022-48150 | 6.1 | Apr 21 | Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI Affected: 5.5.10 |
| CVE-2022-24873 | 6.1 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.0.0 before 5.7.9 |
| CVE-2022-24746 | 6.1 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.1 |
| CVE-2022-21651 | 6.1 | Jan 5 | Shopware is an open source e-commerce software platform Affected: 5.0.0 before 5.7.7 |