Shopware

CVE-2026-23498 Jan 14, 19:16 PHP HIGH PATCH This Week

Shopware versions 6.7.0.0 through 6.7.6.0 contain a code injection vulnerability in the map() function override that fails to validate PHP Closures against an allowlist, enabling authenticated attackers with high privileges to execute arbitrary code. The vulnerability reintroduces a regression from CVE-2023-2017 and affects the open commerce platform's core functionality. A patch is available in version 6.7.6.1.

CVE-2019-12799 Jun 13, 20:29 PHP HIGH POC PATCH THREAT Act Now

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

CVE-2025-67648 Dec 11, 00:16 PHP HIGH PATCH This Week

Shopware, an open commerce platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication controller where the 'waitTime' URL parameter from the login page is rendered directly into the Twig template without validation or sanitization. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 are affected, allowing attackers to inject malicious JavaScript code through crafted URLs. With an EPSS score of only 0.04% (11th percentile), active exploitation appears low despite the availability of patches and public advisories.

CVE-2025-7954 Aug 06, 08:15 PHP MEDIUM POC This Month

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-51541 Aug 05, 20:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-27892 Apr 15, 22:15 PHP MEDIUM POC PATCH This Month

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-32378 Apr 09, 16:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software platform. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-30151 Apr 08, 14:15 PHP HIGH PATCH This Week

Shopware is an open commerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-30150 Apr 08, 14:15 PHP MEDIUM POC PATCH This Month

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-42357 Aug 08, 15:15 PHP CRITICAL PATCH Act Now

Shopware is an open commerce platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

CVE-2024-42356 Aug 08, 15:15 PHP HIGH PATCH This Week

Shopware is an open commerce platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-42355 Aug 08, 15:15 PHP CRITICAL PATCH Act Now

Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-42354 Aug 08, 15:15 PHP MEDIUM PATCH This Month

Shopware is an open commerce platform. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.

CVE-2024-31447 Apr 08, 16:15 PHP MEDIUM PATCH This Month

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required.

CVE-2024-27917 Mar 06, 20:15 PHP HIGH PATCH This Week

Shopware is an open commerce platform based on Symfony Framework and Vue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-22408 Jan 16, 23:15 HIGH This Week

Shopware is an open headless commerce platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-22407 Jan 16, 23:15 PHP MEDIUM PATCH This Month

Shopware is an open headless commerce platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-22406 Jan 16, 23:15 PHP CRITICAL PATCH Act Now

Shopware is an open headless commerce platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-34099 Jun 27, 17:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-34098 Jun 27, 17:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2023-2017 Apr 17, 11:15 PHP HIGH POC PATCH This Week

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-23941 Feb 03, 21:15 PHP HIGH PATCH This Week

SwagPayPal is a PayPal integration for shopware/platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-22734 Jan 17, 22:15 PHP HIGH PATCH This Week

Shopware is an open source commerce platform based on Symfony Framework and Vue js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-22733 Jan 17, 22:15 PHP MEDIUM PATCH This Month

Shopware is an open source commerce platform based on Symfony Framework and Vue js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-22732 Jan 17, 22:15 PHP CRITICAL PATCH Act Now

Shopware is an open source commerce platform based on Symfony Framework and Vue js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2023-22731 Jan 17, 22:15 PHP HIGH PATCH This Week

Shopware is an open source commerce platform based on Symfony Framework and Vue js. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

CVE-2023-22730 Jan 17, 22:15 PHP HIGH PATCH This Week

Shopware is an open source commerce platform based on Symfony Framework and Vue js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-36102 Sep 12, 20:15 PHP HIGH PATCH This Week

Shopware is an open source e-commerce software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-36101 Sep 12, 20:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2022-31148 Aug 01, 17:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-31057 Jun 27, 20:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software made in Germany. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-24892 Apr 28, 15:15 PHP HIGH PATCH This Week

Shopware is an open source e-commerce software platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.

CVE-2022-24879 Apr 28, 15:15 PHP HIGH PATCH This Week

Shopware is an open source e-commerce software platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-24873 Apr 28, 14:15 PHP MEDIUM PATCH This Month

Shopware is an open source e-commerce software platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-24872 Apr 20, 20:15 PHP HIGH PATCH This Week

Shopware is an open commerce platform based on Symfony Framework and Vue. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.

CVE-2022-24871 Apr 20, 19:15 PHP MEDIUM PATCH This Month

Shopware is an open commerce platform based on Symfony Framework and Vue. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

CVE-2022-24956 Mar 29, 02:15 MEDIUM POC This Month

An issue was discovered in Shopware B2B-Suite through 4.4.1. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-24748 Mar 09, 23:15 PHP HIGH PATCH This Week

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.

CVE-2022-24747 Mar 09, 23:15 PHP MEDIUM PATCH This Month

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2022-24746 Mar 09, 23:15 PHP MEDIUM PATCH This Month

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2022-24745 Mar 09, 23:15 PHP MEDIUM PATCH This Month

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-24744 Mar 09, 23:15 PHP LOW PATCH Monitor

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-41188 Oct 26, 15:15 PHP MEDIUM PATCH This Month

Shopware is open source e-commerce software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2021-37711 Aug 16, 23:15 PHP HIGH PATCH This Week

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

CVE-2021-37710 Aug 16, 23:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2021-37709 Aug 16, 22:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-37708 Aug 16, 20:15 PHP CRITICAL PATCH Act Now

Shopware is an open source eCommerce platform. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

CVE-2021-37707 Aug 16, 19:15 PHP HIGH PATCH This Week

Shopware is an open source eCommerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-32717 Jun 24, 21:15 PHP HIGH PATCH This Week

Shopware is an open source eCommerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-32716 Jun 24, 21:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-32713 Jun 24, 21:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2021-32712 Jun 24, 21:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-32711 Jun 24, 20:15 PHP HIGH PATCH This Week

Shopware is an open source eCommerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2021-32710 Jun 24, 20:15 PHP HIGH PATCH This Week

Shopware is an open source eCommerce platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-32709 Jun 24, 19:15 PHP MEDIUM PATCH This Month

Shopware is an open source eCommerce platform. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-13997 Jul 28, 21:15 PHP HIGH PATCH This Week

In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-13971 Jul 28, 21:15 PHP MEDIUM PATCH This Month

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-13970 Jul 28, 21:15 PHP HIGH PATCH This Week

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2019-12935 Jun 23, 23:15 PHP MEDIUM POC PATCH This Month

Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-15374 Oct 16, 04:29 PHP MEDIUM POC This Month

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2016-3109 Apr 21, 20:59 PHP CRITICAL POC PATCH THREAT Act Now

The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 28.6%.