SH
Product
shopware
77
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 28Medium 41Low 2
Watch
Add shopware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-31889 | 8.9 | Mar 11 | Shopware has a potential take over of app credentials Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2023-2017 | 8.8 | Apr 17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows… Affected: 6.1.0 through 6.4.20.0; 6.5.0.0; 6.5.0.0; 6.5.0.0 |
| CVE-2023-22731 | 8.8 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2021-37711 | 8.8 | Aug 16 | Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL Affected: 6.1.0 before 6.4.3.1 |
| CVE-2020-13970 | 8.8 | Jul 28 | Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature Affected: before 6.2.3 |
| CVE-2019-12799 | 8.8 | Jun 13 | In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary… Affected: through 5.6.0 |
| CVE-2018-20713 | 8.8 | Jan 15 | Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404 Affected: before 5.4.3 |
| CVE-2026-104937 | 8.1 | Oct 13 | Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting… Affected: 6.7 |
| CVE-2025-7954 | 8.1 | Aug 6 | Race Condition in Shopware Voucher Submission Affected: 6.6.x; 6.7.x |
| CVE-2024-22408 | 8.1 | Jan 16 | Shopware is an open headless commerce platform Affected: before 6.5.7.4 |
| CVE-2022-24872 | 8.1 | Apr 20 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: before 6.4.10.1 |
| CVE-2022-21652 | 8.1 | Jan 5 | Shopware is an open source e-commerce software platform Affected: 5.7.3 before 5.7.7 |
| CVE-2026-31887 | 7.5 | Mar 11 | Shopware unauthenticated data extraction possible through store-api.order endpoint Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2025-30151 | 7.5 | Apr 8 | Shopware is an open commerce platform Affected: before 6.5.8.17; 6.6.0.0 before 6.6.10.3; 6.7.0.0 |
| CVE-2024-27917 | 7.5 | Mar 6 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: 6.5.8.0 before 6.5.8.7 |
| CVE-2023-22734 | 7.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2023-22730 | 7.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2022-24892 | 7.5 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.0.4 before 5.7.9 |
| CVE-2022-24879 | 7.5 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.2.0 before 5.7.9 |
| CVE-2022-24748 | 7.5 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-37707 | 7.5 | Aug 16 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.3.1 |
| CVE-2021-32717 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.1.1 |
| CVE-2021-32711 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.3.5.1 |
| CVE-2021-32710 | 7.5 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.3.5.2 |
| CVE-2020-13997 | 7.5 | Jul 28 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled Affected: before 6.2.3 |
| CVE-2026-23498 | 7.2 | Jan 14 | Shopware Improper Control of Generation of Code in Twig rendered views Affected: >= 6.7.0.0, < 6.7.6.1 |
| CVE-2024-42356 | 7.2 | Aug 8 | Shopware is an open commerce platform Affected: before 6.5.8.13; 6.6.0.0 before 6.6.5.1 |
| CVE-2022-36102 | 7.2 | Sep 12 | Shopware is an open source e-commerce software Affected: 5.0.0 before 5.7.15 |
Showing 28