SH
Product
shopware
77
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 28Medium 41Low 2
Watch
Add shopware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-12935 | 6.1 | Jun 23 | Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI Affected: before 5.5.8 |
| CVE-2017-15374 | 6.1 | Oct 16 | Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules Affected: 5.2.5; 5.2.6; 5.2.7; 5.2.8; 5.2.9; 5.2.10; +18 more |
| CVE-2024-42354 | 5.9 | Aug 8 | Shopware is an open commerce platform Affected: before 6.5.8.13; 6.6.0.0 before 6.6.5.1 |
| CVE-2022-24871 | 5.5 | Apr 20 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: before 6.4.10.1 |
| CVE-2022-31148 | 5.4 | Aug 1 | Persistent cross site scripting in customer module in Shopware Affected: >= 5.7.0, < 5.7.14 |
| CVE-2022-31057 | 5.4 | Jun 27 | Shopware is an open source e-commerce software made in Germany Affected: 5.0.0 before 5.7.12 |
| CVE-2021-41188 | 5.4 | Oct 26 | Shopware is open source e-commerce software Affected: before 5.7.6 |
| CVE-2021-37710 | 5.4 | Aug 16 | Shopware is an open source eCommerce platform Affected: before 6.4.3.1 |
| CVE-2020-13971 | 5.4 | Jul 28 | In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript Affected: before 6.2.3 |
| CVE-2026-31888 | 5.3 | Mar 11 | Shopware has user enumeration via distinct error codes on Store API login endpoint Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2025-32378 | 5.3 | Apr 9 | Shopware is an open source e-commerce software platform Affected: before 6.5.8.17; 6.6.0.0 before 6.6.10.3; 6.7.0.0 |
| CVE-2025-30150 | 5.3 | Apr 8 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue Affected: before 6.5.8.18; 6.6.0.0 before 6.6.10.3; 6.7.0.0 |
| CVE-2024-31447 | 5.3 | Apr 8 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue Affected: 6.3.5.0 before 6.5.8.8; 6.6.0.0 before 6.6.1.0 |
| CVE-2023-34099 | 5.3 | Jun 27 | Shopware is an open source e-commerce software Affected: 5.1.4 through 5.7.17 |
| CVE-2023-34098 | 5.3 | Jun 27 | Shopware is an open source e-commerce software Affected: 5.6.0 before 5.7.18 |
| CVE-2022-36101 | 5.3 | Sep 12 | Shopware is an open source e-commerce software Affected: 5.0.0 before 5.7.15 |
| CVE-2022-24747 | 5.3 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-32712 | 5.3 | Jun 24 | Shopware is an open source eCommerce platform Affected: 5.0.0 before 5.6.10 |
| CVE-2026-48015 | 4.9 | Jul 17 | Shopware: Stored XSS via SVG file upload — no SVG sanitization Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2021-32716 | 4.9 | Jun 24 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.1.1 |
| CVE-2021-32709 | 4.9 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.4.1.1 |
| CVE-2021-32713 | 4.8 | Jun 24 | Shopware is an open source eCommerce platform Affected: 5.0.0 before 5.6.10 |
| CVE-2026-48012 | 4.3 | Jul 23 | Shopware SSO referer trust leading to an arbitrary redirect target Affected: >= 6.7.3.0, < 6.7.10.1 |
| CVE-2026-48016 | 4.3 | Jul 17 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48013 | 4.1 | Jul 23 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48011 | 3.7 | Jun 10 | Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames Affected: >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18 |
| CVE-2022-24744 | 3.5 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.1 |