CVE-2026-48013 | Medium | 4.1 | 2026-07-23 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to mak… |
CVE-2026-48012 | Medium | 4.3 | 2026-07-23 | Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth… |
CVE-2026-48016 | Medium | 4.3 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChan… |
CVE-2026-48015 | Medium | 4.9 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framework/Resources/confi… |
CVE-2026-48014 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and… |
CVE-2026-48010 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php wr… |
CVE-2026-48009 | Medium | 6.8 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account… |
CVE-2026-48008 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full adminis… |
CVE-2026-48011 | Low | 3.7 | 2026-06-10 | Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by perfo… |
CVE-2026-32142 | Medium | 5.3 | 2026-03-12 | Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15. |
CVE-2026-31889 | High | 8.9 | 2026-03-11 | Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditi… |
CVE-2026-31888 | Medium | 5.3 | 2026-03-11 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error cod… |
CVE-2026-31887 | High | 7.5 | 2026-03-11 | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to… |
CVE-2026-23498 | High | 7.2 | 2026-01-14 | Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checke… |
CVE-2025-67648 | High | 7.1 | 2025-12-11 | Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php… |
CVE-2025-7954 | High | 8.1 | 2025-08-06 | A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrict… |
CVE-2025-51541 | Medium | 6.1 | 2025-08-05 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_… |
CVE-2025-27892 | Medium | 6.8 | 2025-04-15 | Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-202… |
CVE-2025-32378 | Medium | 5.3 | 2025-04-09 | Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsl… |
CVE-2025-30151 | High | 7.5 | 2025-04-08 | Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vu… |
CVE-2025-30150 | Medium | 5.3 | 2025-04-08 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail ad… |
CVE-2024-42357 | High | 7.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users… |
CVE-2024-42356 | High | 8.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to a… |
CVE-2024-42355 | High | 8.3 | 2024-08-08 | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to ver… |
CVE-2024-42354 | Medium | 5.3 | 2024-08-08 | Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiA… |
CVE-2024-31447 | Medium | 5.3 | 2024-04-08 | Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authe… |
CVE-2024-27917 | High | 7.5 | 2024-03-06 | Shopware is an open commerce platform based on Symfony Framework and Vue. The Symfony Session Handler pops the Session Cookie and assigns it to the Response. S… |
CVE-2024-22408 | High | 7.6 | 2024-01-16 | Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL use… |
CVE-2024-22407 | Medium | 4.9 | 2024-01-16 | Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions… |
CVE-2024-22406 | Critical | 9.3 | 2024-01-16 | Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information… |
CVE-2023-34099 | Medium | 5.3 | 2023-06-27 | Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail… |
CVE-2023-34098 | Medium | 5.3 | 2023-06-27 | Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be re… |
CVE-2022-48150 | Medium | 6.1 | 2023-04-21 | Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. |
CVE-2023-2017 | High | 8.8 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub rep… |
CVE-2023-23941 | High | 7.5 | 2023-02-03 | SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay L… |
CVE-2023-22734 | Medium | 4.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it wa… |
CVE-2023-22733 | Low | 2.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails… |
CVE-2023-22732 | Low | 3.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker… |
CVE-2023-22731 | Critical | 9.9 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to… |
CVE-2023-22730 | Medium | 5.3 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple tim… |
CVE-2022-36102 | Medium | 6.3 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed… |
CVE-2022-36101 | Medium | 5.4 | 2022-09-12 | Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive… |
CVE-2022-31148 | Medium | 5.4 | 2022-08-01 | Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Use… |
CVE-2022-31057 | Medium | 6.5 | 2022-06-27 | Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Ad… |
CVE-2022-24892 | Medium | 6.4 | 2022-04-28 | Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be reques… |
CVE-2022-24879 | High | 7.5 | 2022-04-28 | Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token valid… |
CVE-2022-24873 | Medium | 5.4 | 2022-04-28 | Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. T… |
CVE-2022-24872 | High | 8.1 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal… |
CVE-2022-24871 | High | 7.2 | 2022-04-20 | Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the Admin SDK functionality on the server… |
CVE-2022-24956 | Medium | 6.5 | 2022-03-29 | An issue was discovered in Shopware B2B-Suite through 4.4.1. The sort-by parameter of the search functionality of b2border and b2borderlist allows SQL injectio… |
CVE-2022-24748 | Medium | 6.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modif… |
CVE-2022-24747 | Medium | 6.3 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sen… |
CVE-2022-24746 | Medium | 6.1 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code v… |
CVE-2022-24745 | Medium | 4.8 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions guest sessions are shared betwe… |
CVE-2022-24744 | Low | 2.6 | 2022-03-09 | Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged ou… |
CVE-2022-21652 | Low | 3.5 | 2022-01-05 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. W… |
CVE-2022-21651 | Medium | 6.8 | 2022-01-05 | Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplet… |
CVE-2021-41188 | Medium | 5.7 | 2021-10-26 | Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two… |
CVE-2021-37711 | High | 8.8 | 2021-08-16 | Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As worka… |
CVE-2021-37710 | High | 8.0 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 cont… |
CVE-2021-37709 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of… |
CVE-2021-37708 | High | 8.8 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 cont… |
CVE-2021-37707 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6… |
CVE-2021-32717 | High | 7.5 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL… |
CVE-2021-32716 | Medium | 4.4 | 2021-06-24 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been… |
CVE-2021-32713 | Medium | 4.8 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are reco… |
CVE-2021-32712 | Medium | 5.3 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to… |
CVE-2021-32711 | Critical | 9.1 | 2021-06-24 | Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changi… |
CVE-2021-32710 | Medium | 5.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current… |
CVE-2021-32709 | Medium | 4.9 | 2021-06-24 | Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current… |
CVE-2020-13997 | High | 7.5 | 2020-07-28 | In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled. |
CVE-2020-13971 | Medium | 5.4 | 2020-07-28 | In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to… |
CVE-2020-13970 | High | 8.8 | 2020-07-28 | Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to s… |
CVE-2019-12935 | High | 7.4 | 2019-06-23 | Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI. |
CVE-2019-12799 | High | 8.8 | 2019-06-13 | In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in… |
CVE-2018-20713 | High | 8.8 | 2019-01-15 | Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404. |
CVE-2017-18357 | Medium | 6.5 | 2019-01-15 | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_Product… |
CVE-2017-15374 | Medium | 6.1 | 2017-10-16 | Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attacke… |
CVE-2016-3109 | Critical | 9.8 | 2017-04-21 | The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. |