Security
فارسی
All products

shopware/core

Composer · Package
65 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Shopware: Unauthenticated data extraction possible through store-api.order endpointCVE-2026-31887 · GHSA-7VVP-J573-5584 shopware/coreshopware/platform Composer High Fix reported
Shopware: Stored XSS via SVG file upload — no SVG sanitizationCVE-2026-48015 · GHSA-XVHC-GM7J-MHMC shopware/coreshopware/platform Composer Medium Fix reported
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accountsCVE-2026-48010 · GHSA-V39M-97P8-GQG7 shopware/coreshopware/platform Composer Medium Fix reported
Shopware: SSRF in Media External-Link Endpoint Bypasses IP ValidationCVE-2026-48013 · GHSA-GQ96-5PFX-F4VC shopware/coreshopware/platform Composer Medium Fix reported
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-paymentCVE-2026-48016 · GHSA-9V5M-39WH-5CHQ shopware/coreshopware/platform Composer Medium Fix reported
Shopware: Privilege Escalation via Sync API Integration Admin Flag BypassCVE-2026-48008 · GHSA-GV8P-48FR-4FXG shopware/coreshopware/platform Composer Medium Fix reported
Shopware vulnerable to a potential take over of app credentialsCVE-2026-31889 · GHSA-C4P7-RWRG-PF6P shopware/coreshopware/platform Composer High Fix reported
Shopware: Admin API ACL Bypass in Order State Transition EndpointsCVE-2026-48014 · GHSA-F8Q6-3G5W-JJR6 shopware/coreshopware/platform Composer Medium Fix reported
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernamesCVE-2026-48011 · GHSA-7W52-7JVM-M9VW shopware/coreshopware/platform Composer Low Fix reported
Shopware SSO referer trust leading to an arbitrary redirect targetCVE-2026-48012 · GHSA-4X3X-869W-XX3M shopware/coreshopware/platform Composer Medium Fix reported
Shopware: Admin Account Takeover via User Recovery Hash ExposureCVE-2026-48009 · GHSA-8V9P-G828-V98F shopware/coreshopware/platform Composer Medium Fix reported
Shopware has user enumeration via distinct error codes on Store API login endpointCVE-2026-31888 · GHSA-GQC5-XV7M-GCJQ shopware/coreshopware/platform Composer Medium Fix reported
Shopware 6's password recovery link does not expire after email changeGHSA-2W46-VQ8H-98VH shopware/core Composer Medium Fix reported
Shopware Customer Orders can be canceled, even if refunds are disabledGHSA-R2VG-HVJM-FG38 shopware/coreshopware/platform Composer Medium Fix reported
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individuallyGHSA-M895-2HJ3-8CG9 shopware/coreshopware/platform Composer Medium Fix reported
Shopware exposes sensitive user information via CSV export mappingGHSA-27C9-VP3W-6WW8 shopware/coreshopware/platform Composer Medium Fix reported
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoiceGHSA-3CPP-FV95-MPR5 shopware/coreshopware/platform Composer Low Fix reported
Shopware vulnerable to path traversal via Plugin uploadGHSA-6WH5-MW9H-5C3W shopware/coreshopware/platform Composer Low Fix reported
Shopware Improper Session Handling in store-api account logoutCVE-2024-31447 · GHSA-5297-WRRP-RCJ7 shopware/coreshopware/platform Composer Medium Fix reported
Blind SQL injection in shopwareCVE-2024-22406 · GHSA-QMP9-2XWJ-M6M9 shopware/coreshopware/platform Composer Critical Fix reported