Shopware vulnerabilities
67 CVEs and advisories name Shopware as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-34098Dependency configuration exposed in Shopware
- CVE-2023-2017Improper Control of Generation of Code in Twig Rendered Views in Shopware
- CVE-2023-23941SwagPayPal payment not sent to PayPal correctly
- CVE-2023-22733Improper Output Neutralization in Log Module in shopware
- CVE-2023-22732Insufficient Session Expiration in Administration in shopware
- CVE-2023-22731Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2023-22730Improper Input Validation of Clearance sale in cart
- CVE-2023-22734Improper Input Newsletter subscription option validation in shopware
- CVE-2022-36102Acess control list bypassed via crafted specific URLs
- CVE-2022-36101Sensitive data in backend customer module
- CVE-2022-31148Persistent cross site scripting in customer module in Shopware
- CVE-2022-31057Authenticated Stored XSS in Shopware Administration
- CVE-2022-24892Multiple valid tokens for password reset in Shopware
- CVE-2022-24879Malfunction of Cross-Site Request Forgery token validation
- CVE-2022-24873Non-Stored Cross-site Scripting in Shopware storefront
- CVE-2022-24872Improper Access Control in shopware
- CVE-2022-24871Server-Side Request Forgery (SSRF) in Shopware
- CVE-2022-24744Insufficient Session Expiration in shopware
- CVE-2022-24745Guest session is shared between customers in shopware
- CVE-2022-24746HTML injection possibility in voucher code form
- CVE-2022-24747HTTP caching is marking private HTTP headers as public
- CVE-2022-24748Incorrect Authentication in shopware
- CVE-2022-21652Insufficient Session Expiration in shopware
- CVE-2022-21651Open redirect in shopware
- CVE-2021-41188Authenticated Stored XSS in Administration
- CVE-2021-37711Authenticated server-side request forgery in file upload via URL.
- CVE-2021-37710Cross-Site Scripting via SVG media files
- CVE-2021-37709Insecure direct object reference of log files of the Import/Export feature
- CVE-2021-37708Command injection in mail agent settings
- CVE-2021-37707Manipulation of product reviews via API