Shopware platform

• CVE-2026-48012 Medium 4.3 Shopware SSO referer trust leading to an arbitrary redirect target 0.3%
• CVE-2026-48013 Medium 4.1 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation 0.4%
• CVE-2026-48009 Medium 6.8 Shopware: Admin Account Takeover via User Recovery Hash Exposure 0.5%
• CVE-2026-48014 Medium 6.5 Shopware: Admin API ACL Bypass in Order State Transition Endpoints 0.4%
• CVE-2026-48010 Medium 6.5 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 0.5%
• CVE-2026-48016 Medium 4.3 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 0.4%
• CVE-2026-48015 Medium 4.9 Shopware: Stored XSS via SVG file upload — no SVG sanitization 0.5%
• CVE-2026-48008 Medium 6.5 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 0.5%
• CVE-2026-31889 High 8.9 Shopware has a potential take over of app credentials 0.3%
• CVE-2026-31888 Medium 5.3 Shopware has user enumeration via distinct error codes on Store API login endpoint 0.3%
• CVE-2026-31887 High 8.9 Shopware unauthenticated data extraction possible through store-api.order endpoint 0.3%
• CVE-2023-22733 Low 2.7 Improper Output Neutralization in Log Module in shopware 0.7%
• CVE-2023-22732 Low 3.7 Insufficient Session Expiration in Administration in shopware 0.8%
• CVE-2023-22731 Critical 10.0 Improper Control of Generation of Code in Twig rendered views in shopware 1.4%
• CVE-2023-22730 Medium 5.3 Improper Input Validation of Clearance sale in cart 0.7%
• CVE-2023-22734 Medium 4.3 Improper Input Newsletter subscription option validation in shopware 0.6%
• CVE-2022-24872 High 8.1 Improper Access Control in shopware 1.1%
• CVE-2022-24871 High 7.2 Server-Side Request Forgery (SSRF) in Shopware 1.1%
• CVE-2022-24744 Low 2.6 Insufficient Session Expiration in shopware 0.5%
• CVE-2022-24745 Medium 4.8 Guest session is shared between customers in shopware 0.5%
• CVE-2022-24746 Medium 6.1 HTML injection possibility in voucher code form 0.8%
• CVE-2022-24747 Medium 6.3 HTTP caching is marking private HTTP headers as public 1.1%
• CVE-2022-24748 Medium 6.8 Incorrect Authentication in shopware 0.8%
• CVE-2021-37711 High 8.8 Authenticated server-side request forgery in file upload via URL. 1.1%
• CVE-2021-37710 High 8.0 Cross-Site Scripting via SVG media files 0.7%
• CVE-2021-37709 Medium 6.5 Insecure direct object reference of log files of the Import/Export feature 0.8%
• CVE-2021-37708 High 8.8 Command injection in mail agent settings 2.4%
• CVE-2021-37707 Medium 6.5 Manipulation of product reviews via API 0.9%
• CVE-2021-32717 High 7.5 Private files publicly accessible with Cloud Storage providers 1.5%
• CVE-2021-32716 Medium 4.4 Internal hidden fields are visible on to many associations in admin api 1.1%
• CVE-2021-32711 Critical 9.1 Leak of information via Store-API 1.4%
• CVE-2021-32710 Medium 5.9 Potential Session Hijacking in Shopware 0.9%
• CVE-2021-32709 Medium 4.9 Creation of order credits was not validated by acl in admin orders 0.6%