CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/03/2022 |
| GHSA-r64m-qchj-hrjp | 严重 | Webcache Poisoning in shopware/platform and shopware/core | 24/11/2021 |
| CVE-2021-37711 | 高危8.8 | Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | 16/08/2021 |
| CVE-2021-37710 | 中危5.4 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | 16/08/2021 |
| CVE-2021-37709 | 中危6.5 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of the Import/Export feature. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also ava | 16/08/2021 |
| CVE-2021-37708 | 严重9.8 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | 16/08/2021 |
| CVE-2021-37707 | 高危7.5 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. | 16/08/2021 |
| GHSA-243q-g9j3-qf6r | 中危 | non-admin users can create integration role with administrator role | 28/06/2021 |
| GHSA-wq3r-jwrq-xg6w | 中危 | Canceling of orders not related to the logged-in user | 28/06/2021 |
| CVE-2021-32717 | 高危7.5 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the sam | 24/06/2021 |
| CVE-2021-32716 | 中危4.9 | Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly v | 24/06/2021 |
| CVE-2021-32711 | 高危7.5 | Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We recommend to update to | 24/06/2021 |
| CVE-2021-32710 | 高危7.5 | Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corre | 24/06/2021 |
| CVE-2021-32709 | 中危4.9 | Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3 | 24/06/2021 |
| GHSA-88rc-3p98-rgvx | 严重 | After order payment process manipulation in shopware/platform and shopware/core | 13/04/2021 |
| GHSA-qg7c-q3vq-rgxr | 严重 | Leak of information via Store-API aggregations in shopware/platform and shopware/core | 13/04/2021 |
| GHSA-pjj4-jjgc-h3r8 | 中危 | Authenticated remote code execution | 12/03/2021 |
| GHSA-jvg4-9rc2-wvcr | 低危 | Generation of fake documents via public GET-call | 10/02/2021 |