Known vulnerabilities in Shopware

Vendor: Shopware
Software: Shopware
Software CPE: cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*
Total vulnerabilities: 118
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Shopware Shopware is affected by 118 known vulnerabilities: 13 high, 51 medium, 54 low Critical High Medium Low

Vulnerabilities (118)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150744 - Improper Enforcement of Behavioral Workflow
CWE-841 Medium
No
No
6.6.10.25, 6.7.14.1 17.09.2026 SB20260917249
#VU150743 - Missing Authorization
CWE-862 Medium
No
No
6.6.10.25, 6.7.14.1 17.09.2026 SB20260917249
#VU150742 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 High
No
No
6.6.10.25, 6.7.14.1 17.09.2026 SB20260917249
#VU150741 - Improper Access Control
CWE-284 Medium
No
No
6.6.10.25, 6.7.14.1 17.09.2026 SB20260917249
#VU150740 - Improper Authorization
CWE-285 Low
No
No
6.6.10.25, 6.7.14.1 17.09.2026 SB20260917249
#VU145373 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145372 - Improper Restriction of Excessive Authentication Attempts
CWE-307 Low
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145371 - Server-Side Request Forgery (SSRF)
CWE-918 Low
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145370 - Incorrect Authorization
CWE-863 Medium
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145369 - Weak password recovery mechanism
CWE-640 High
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145368 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 High
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145367 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-1336 High
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145366 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 Low
No
No
6.7.13.1 25.08.2026 SB20260825139
#VU145365 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915 Low
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU145364 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Low
No
No
6.6.10.23, 6.7.13.1 25.08.2026 SB20260825139
#VU131952 - Authorization Bypass Through User-Controlled Key
CVE-2026-48016
CWE-639 Low
No
No
6.6.10.18, 6.7.10.1 20.05.2026 SB2026052059
#VU131951 - Server-Side Request Forgery (SSRF)
CVE-2026-48013
CWE-918 Low
No
No
6.7.10.1 20.05.2026 SB2026052059
#VU131950 - Improper input validation
CVE-2026-48012
CWE-20 Low
No
No
6.7.10.1 20.05.2026 SB2026052059
#VU131949 - Improper Privilege Management
CVE-2026-48010
CWE-269 Low
No
No
6.6.10.18, 6.7.10.1 20.05.2026 SB2026052059
#VU131948 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-48015
CWE-79 Low
No
No
6.6.10.18, 6.7.10.1 20.05.2026 SB2026052059


Showing elements 1 - 20 out of 118