# cve.now: Shopware

The newest entries naming Shopware as an affected vendor (up to 200), of 67 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104937](https://cve.now/CVE-2026-104937.md): CVE-2026-104937 (CVSS 8.1)
- [CVE-2026-48012](https://cve.now/CVE-2026-48012.md): Shopware SSO referer trust leading to an arbitrary redirect target (CVSS 4.3)
- [CVE-2026-48013](https://cve.now/CVE-2026-48013.md): Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation (CVSS 4.1)
- [CVE-2026-48009](https://cve.now/CVE-2026-48009.md): Shopware: Admin Account Takeover via User Recovery Hash Exposure (CVSS 6.8)
- [CVE-2026-48014](https://cve.now/CVE-2026-48014.md): Shopware: Admin API ACL Bypass in Order State Transition Endpoints (CVSS 6.5)
- [CVE-2026-48010](https://cve.now/CVE-2026-48010.md): Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts (CVSS 6.5)
- [CVE-2026-48016](https://cve.now/CVE-2026-48016.md): Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment (CVSS 4.3)
- [CVE-2026-48015](https://cve.now/CVE-2026-48015.md): Shopware: Stored XSS via SVG file upload — no SVG sanitization (CVSS 4.9)
- [CVE-2026-48008](https://cve.now/CVE-2026-48008.md): Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass (CVSS 6.5)
- [CVE-2026-48011](https://cve.now/CVE-2026-48011.md): Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames (CVSS 3.7)
- [CVE-2026-32142](https://cve.now/CVE-2026-32142.md): shopware/commercial: \`/api/\_info/config\` route exposes information about licenses (CVSS 5.3)
- [CVE-2026-31889](https://cve.now/CVE-2026-31889.md): Shopware has a potential take over of app credentials (CVSS 8.9)
- [CVE-2026-31888](https://cve.now/CVE-2026-31888.md): Shopware has user enumeration via distinct error codes on Store API login endpoint (CVSS 5.3)
- [CVE-2026-31887](https://cve.now/CVE-2026-31887.md): Shopware unauthenticated data extraction possible through store-api.order endpoint (CVSS 8.9)
- [CVE-2026-23498](https://cve.now/CVE-2026-23498.md): Shopware Improper Control of Generation of Code in Twig rendered views (CVSS 7.2)
- [CVE-2025-67648](https://cve.now/CVE-2025-67648.md): Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page (CVSS 7.1)
- [CVE-2025-7954](https://cve.now/CVE-2025-7954.md): Race Condition in Shopware Voucher Submission (CVSS 6.0)
- [CVE-2025-32378](https://cve.now/CVE-2025-32378.md): Shopware's default newsletter opt-in settings allow for mass sign-up abuse (CVSS 6.9)
- [CVE-2025-30150](https://cve.now/CVE-2025-30150.md): Shopware 6 allows attackers to check for registered accounts through the store-api (CVSS 5.5)
- [CVE-2025-30151](https://cve.now/CVE-2025-30151.md): Shopware allows Denial Of Service via password length (CVSS 7.5)
- [CVE-2024-42357](https://cve.now/CVE-2024-42357.md): Shopware vulnerable to blind SQL-injection in DAL aggregations (CVSS 7.3)
- [CVE-2024-42356](https://cve.now/CVE-2024-42356.md): Shopware vulnerable to Server Side Template Injection in Twig using Context functions (CVSS 8.3)
- [CVE-2024-42355](https://cve.now/CVE-2024-42355.md): Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag (CVSS 8.3)
- [CVE-2024-42354](https://cve.now/CVE-2024-42354.md): Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api (CVSS 5.3)
- [CVE-2024-31447](https://cve.now/CVE-2024-31447.md): Shopware has Improper Session Handling in store-api (CVSS 5.3)
- [CVE-2024-27917](https://cve.now/CVE-2024-27917.md): Shopware's session is persistent in Cache for 404 pages (CVSS 7.5)
- [CVE-2024-22406](https://cve.now/CVE-2024-22406.md): Blind SQL-injection in DAL aggregations in Shopware (CVSS 9.3)
- [CVE-2024-22407](https://cve.now/CVE-2024-22407.md): Broken Access Control order API in Shopware (CVSS 4.9)
- [CVE-2024-22408](https://cve.now/CVE-2024-22408.md): Server-Side Request Forgery (SSRF) in Shopware Flow Builder (CVSS 7.6)
- [CVE-2023-34099](https://cve.now/CVE-2023-34099.md): Improper mail validation in Shopware (CVSS 5.3)
- [CVE-2023-34098](https://cve.now/CVE-2023-34098.md): Dependency configuration exposed in Shopware (CVSS 5.3)
- [CVE-2023-2017](https://cve.now/CVE-2023-2017.md): Improper Control of Generation of Code in Twig Rendered Views in Shopware (CVSS 8.8)
- [CVE-2023-23941](https://cve.now/CVE-2023-23941.md): SwagPayPal payment not sent to PayPal correctly (CVSS 7.5)
- [CVE-2023-22733](https://cve.now/CVE-2023-22733.md): Improper Output Neutralization in Log Module in shopware (CVSS 2.7)
- [CVE-2023-22732](https://cve.now/CVE-2023-22732.md): Insufficient Session Expiration in Administration in shopware (CVSS 3.7)
- [CVE-2023-22731](https://cve.now/CVE-2023-22731.md): Improper Control of Generation of Code in Twig rendered views in shopware (CVSS 10.0)
- [CVE-2023-22730](https://cve.now/CVE-2023-22730.md): Improper Input Validation of Clearance sale in cart (CVSS 5.3)
- [CVE-2023-22734](https://cve.now/CVE-2023-22734.md): Improper Input Newsletter subscription option validation in shopware (CVSS 4.3)
- [CVE-2022-36102](https://cve.now/CVE-2022-36102.md): Acess control list bypassed via crafted specific URLs (CVSS 6.3)
- [CVE-2022-36101](https://cve.now/CVE-2022-36101.md): Sensitive data in backend customer module (CVSS 5.4)
- [CVE-2022-31148](https://cve.now/CVE-2022-31148.md): Persistent cross site scripting in customer module in Shopware (CVSS 5.4)
- [CVE-2022-31057](https://cve.now/CVE-2022-31057.md): Authenticated Stored XSS in Shopware Administration (CVSS 6.5)
- [CVE-2022-24892](https://cve.now/CVE-2022-24892.md): Multiple valid tokens for password reset in Shopware (CVSS 6.4)
- [CVE-2022-24879](https://cve.now/CVE-2022-24879.md): Malfunction of Cross-Site Request Forgery token validation (CVSS 7.5)
- [CVE-2022-24873](https://cve.now/CVE-2022-24873.md): Non-Stored Cross-site Scripting in Shopware storefront (CVSS 5.4)
- [CVE-2022-24872](https://cve.now/CVE-2022-24872.md): Improper Access Control in shopware (CVSS 8.1)
- [CVE-2022-24871](https://cve.now/CVE-2022-24871.md): Server-Side Request Forgery (SSRF) in Shopware (CVSS 7.2)
- [CVE-2022-24744](https://cve.now/CVE-2022-24744.md): Insufficient Session Expiration in shopware (CVSS 2.6)
- [CVE-2022-24745](https://cve.now/CVE-2022-24745.md): Guest session is shared between customers in shopware (CVSS 4.8)
- [CVE-2022-24746](https://cve.now/CVE-2022-24746.md): HTML injection possibility in voucher code form (CVSS 6.1)
- [CVE-2022-24747](https://cve.now/CVE-2022-24747.md): HTTP caching is marking private HTTP headers as public (CVSS 6.3)
- [CVE-2022-24748](https://cve.now/CVE-2022-24748.md): Incorrect Authentication in shopware (CVSS 6.8)
- [CVE-2022-21652](https://cve.now/CVE-2022-21652.md): Insufficient Session Expiration in shopware (CVSS 3.5)
- [CVE-2022-21651](https://cve.now/CVE-2022-21651.md): Open redirect in shopware (CVSS 6.8)
- [CVE-2021-41188](https://cve.now/CVE-2021-41188.md): Authenticated Stored XSS in Administration (CVSS 5.7)
- [CVE-2021-37711](https://cve.now/CVE-2021-37711.md): Authenticated server-side request forgery in file upload via URL. (CVSS 8.8)
- [CVE-2021-37710](https://cve.now/CVE-2021-37710.md): Cross-Site Scripting via SVG media files (CVSS 8.0)
- [CVE-2021-37709](https://cve.now/CVE-2021-37709.md): Insecure direct object reference of log files of the Import/Export feature (CVSS 6.5)
- [CVE-2021-37708](https://cve.now/CVE-2021-37708.md): Command injection in mail agent settings (CVSS 8.8)
- [CVE-2021-37707](https://cve.now/CVE-2021-37707.md): Manipulation of product reviews via API (CVSS 6.5)
- [CVE-2021-32717](https://cve.now/CVE-2021-32717.md): Private files publicly accessible with Cloud Storage providers (CVSS 7.5)
- [CVE-2021-32716](https://cve.now/CVE-2021-32716.md): Internal hidden fields are visible on to many associations in admin api (CVSS 4.4)
- [CVE-2021-32712](https://cve.now/CVE-2021-32712.md): Information leakage in Error Handler (CVSS 5.3)
- [CVE-2021-32713](https://cve.now/CVE-2021-32713.md): Authenticated Stored XSS (CVSS 4.8)
- [CVE-2021-32711](https://cve.now/CVE-2021-32711.md): Leak of information via Store-API (CVSS 9.1)
- [CVE-2021-32710](https://cve.now/CVE-2021-32710.md): Potential Session Hijacking in Shopware (CVSS 5.9)
- [CVE-2021-32709](https://cve.now/CVE-2021-32709.md): Creation of order credits was not validated by acl in admin orders (CVSS 4.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/shopware
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.