SH
Product
shopware
77
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 6High 28Medium 41Low 2
Watch
Add shopware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48009 | 6.8 | Jul 17 | Shopware: Admin Account Takeover via User Recovery Hash Exposure Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2025-27892 | 6.8 | Apr 15 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint Affected: before 6.5.8.17; 6.6.0.0 before 6.6.10.3; 6.7.0.0 |
| CVE-2026-48014 | 6.5 | Jul 17 | Shopware: Admin API ACL Bypass in Order State Transition Endpoints Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48010 | 6.5 | Jul 17 | Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48008 | 6.5 | Jul 17 | Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2024-22407 | 6.5 | Jan 16 | Shopware is an open headless commerce platform Affected: before 6.5.7.4 |
| CVE-2023-22733 | 6.5 | Jan 17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js Affected: before 6.4.18.1 |
| CVE-2022-24745 | 6.5 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-37709 | 6.5 | Aug 16 | Shopware is an open source eCommerce platform Affected: before 6.4.3.1 |
| CVE-2017-18357 | 6.5 | Jan 15 | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller,… Affected: before 5.3.4 |
| CVE-2025-67648 | 6.1 | Dec 10 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page Affected: >= 6.4.6.0, < 6.6.10.10; >= 6.7.0.0, < 6.7.5.1 |
| CVE-2025-51541 | 6.1 | Aug 5 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/ Affected: 6.1.0 before 6.2.3 |
| CVE-2022-48150 | 6.1 | Apr 21 | Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI Affected: 5.5.10 |
| CVE-2022-24873 | 6.1 | Apr 28 | Shopware is an open source e-commerce software platform Affected: 5.0.0 before 5.7.9 |
| CVE-2022-24746 | 6.1 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.1 |
| CVE-2022-21651 | 6.1 | Jan 5 | Shopware is an open source e-commerce software platform Affected: 5.0.0 before 5.7.7 |
| CVE-2019-12935 | 6.1 | Jun 23 | Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI Affected: before 5.5.8 |
| CVE-2017-15374 | 6.1 | Oct 16 | Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules Affected: 5.2.5; 5.2.6; 5.2.7; 5.2.8; 5.2.9; 5.2.10; +18 more |
| CVE-2024-42354 | 5.9 | Aug 8 | Shopware is an open commerce platform Affected: before 6.5.8.13; 6.6.0.0 before 6.6.5.1 |
| CVE-2022-24871 | 5.5 | Apr 20 | Shopware is an open commerce platform based on Symfony Framework and Vue Affected: before 6.4.10.1 |
| CVE-2022-31148 | 5.4 | Aug 1 | Persistent cross site scripting in customer module in Shopware Affected: >= 5.7.0, < 5.7.14 |
| CVE-2022-31057 | 5.4 | Jun 27 | Shopware is an open source e-commerce software made in Germany Affected: 5.0.0 before 5.7.12 |
| CVE-2021-41188 | 5.4 | Oct 26 | Shopware is open source e-commerce software Affected: before 5.7.6 |
| CVE-2021-37710 | 5.4 | Aug 16 | Shopware is an open source eCommerce platform Affected: before 6.4.3.1 |
| CVE-2020-13971 | 5.4 | Jul 28 | In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript Affected: before 6.2.3 |
| CVE-2026-31888 | 5.3 | Mar 11 | Shopware has user enumeration via distinct error codes on Store API login endpoint Affected: before 6.6.10.15; 6.7.0.0 before 6.7.8.1 |
| CVE-2025-32378 | 5.3 | Apr 9 | Shopware's default newsletter opt-in settings allow for mass sign-up abuse Affected: < 6.5.8.17; >= 6.6.0.0, < 6.6.10.3; >= 6.7.0.0-rc1, < 6.7.0.0-rc2 |
| CVE-2025-30150 | 5.3 | Apr 8 | Shopware 6 allows attackers to check for registered accounts through the store-api Affected: < 6.5.8.17; >= 6.6.0.0, < 6.6.10.3; >= 6.7.0.0-rc1, < 6.7.0.0-rc2 |
| CVE-2024-31447 | 5.3 | Apr 8 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue Affected: 6.3.5.0 before 6.5.8.8; 6.6.0.0 before 6.6.1.0 |
| CVE-2023-34099 | 5.3 | Jun 27 | Shopware is an open source e-commerce software Affected: 5.1.4 through 5.7.17 |
| CVE-2023-34098 | 5.3 | Jun 27 | Shopware is an open source e-commerce software Affected: 5.6.0 before 5.7.18 |
| CVE-2022-36101 | 5.3 | Sep 12 | Shopware is an open source e-commerce software Affected: 5.0.0 before 5.7.15 |
| CVE-2022-24747 | 5.3 | Mar 9 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework Affected: before 6.4.8.2 |
| CVE-2021-32712 | 5.3 | Jun 24 | Shopware is an open source eCommerce platform Affected: 5.0.0 before 5.6.10 |
| CVE-2026-48015 | 4.9 | Jul 17 | Shopware: Stored XSS via SVG file upload — no SVG sanitization Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2021-32716 | 4.9 | Jun 24 | Shopware is an open source eCommerce platform Affected: 6.1.0 before 6.4.1.1 |
| CVE-2021-32709 | 4.9 | Jun 24 | Shopware is an open source eCommerce platform Affected: before 6.4.1.1 |
| CVE-2021-32713 | 4.8 | Jun 24 | Shopware is an open source eCommerce platform Affected: 5.0.0 before 5.6.10 |
| CVE-2026-48012 | 4.3 | Jul 23 | Shopware SSO referer trust leading to an arbitrary redirect target Affected: >= 6.7.3.0, < 6.7.10.1 |
| CVE-2026-48016 | 4.3 | Jul 17 | Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
| CVE-2026-48013 | 4.1 | Jul 23 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation Affected: < 6.6.10.18; >= 6.7.0.0, < 6.7.10.1 |
Showing 41