| CVE-2026-23498 | 高7.2 | Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1. | 14/01/2026 |
| CVE-2025-67648 | 中6.1 | Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input valida | 11/12/2025 |
| GHSA-9v82-vcjx-m76j | 高8.8 | Shopware: Reflective Cross Site-Scripting (XSS) in CMS components | 10/09/2025 |
| GHSA-83jv-4prm-34g7 | 緊急9.8 | Shopware Remote Code Execution Vulnerability | 21/05/2024 |
| GHSA-7336-ghhp-f2qj | 緊急9.8 | Shopware Remote Code Execution Vulnerability | 21/05/2024 |
| GHSA-jqr7-5h7r-ch8p | 中6.1 | Shopware Non-Persistent XSS in the Frontend | 21/05/2024 |
| GHSA-q3g4-2vw9-xv27 | 緊急9.8 | Shopware Remote Code Execution Vulnerability | 21/05/2024 |
| CVE-2023-34099 | 中5.3 | Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advise | 27/06/2023 |
| CVE-2023-34098 | 中5.3 | Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attack | 27/06/2023 |
| CVE-2022-48150 | 中6.1 | Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. | 21/04/2023 |
| CVE-2022-36102 | 高7.2 | Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via | 12/09/2022 |
| CVE-2022-36101 | 中5.3 | Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update ei | 12/09/2022 |
| CVE-2022-31148 | 中5.4 | Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. | 01/08/2022 |
| CVE-2022-31057 | 中5.4 | Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue. | 27/06/2022 |
| CVE-2022-24892 | 高7.5 | Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the v | 28/04/2022 |
| CVE-2022-24879 | 高7.5 | Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older ver | 28/04/2022 |
| CVE-2022-24873 | 中6.1 | Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin. | 28/04/2022 |
| CVE-2022-21652 | 高8.1 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login | 05/01/2022 |
| CVE-2022-21651 | 中6.1 | Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible | 05/01/2022 |
| CVE-2021-41188 | 中5.4 | Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in | 26/10/2021 |