{"kind": "product", "path": "vulns/packagist/shopware%2Fshopware", "name": "shopware/shopware", "product": "shopware/shopware", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-23498", "noindex": false, "published": "2026-01-14T18:31:19.070Z", "modified": "2026-01-14T21:15:57.391Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00442, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-23498", "title": "Shopware Improper Control of Generation of Code in Twig rendered views", "description": "Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override. This vulnerability is fixed in 6.7.6.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-7cw6-7h3h-v8pf", "https://github.com/shopware/shopware/commit/3966b05590e29432b8485ba47b4fcd14dd0b8475", "https://nvd.nist.gov/vuln/detail/CVE-2026-23498"], "fixes": ["6.7.6.1"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-67648", "noindex": false, "published": "2025-12-10T23:55:10.060Z", "modified": "2025-12-11T19:00:14.044Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.00188, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-67648", "title": "Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page", "description": "Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2", "https://github.com/shopware/shopware/commit/c9242c02c84595d9fa3e2adf6a264bc90a657b58", "https://nvd.nist.gov/vuln/detail/CVE-2025-67648"], "fixes": ["6.6.10.10", "6.7.5.1"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}, {"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "GHSA-9v82-vcjx-m76j", "noindex": false, "published": "2025-09-10T20:46:20Z", "modified": "2025-09-10T21:04:26.017198Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-9v82-vcjx-m76j", "title": "Shopware: Reflective Cross Site-Scripting (XSS) in CMS components", "description": "### Impact\nBy exploiting XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. \n\nSome examples of this include, but are not limited to:\n- Obtaining user session tokens.\n- Performing administrative actions (when an administrative user is affected).\n\nThese vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.\n\n#### Description\nWhen an application uses input f", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-9v82-vcjx-m76j", "https://github.com/shopware/shopware/commit/12fb537c5ebe009f2a0f58b9c24dbd2d6b4c508f", "https://github.com/shopware/shopware"], "fixes": ["6.7.2.1"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "GHSA-83jv-4prm-34g7", "noindex": false, "published": "2024-05-21T21:00:39Z", "modified": "2024-12-06T05:35:31.476394Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-83jv-4prm-34g7", "title": "Shopware Remote Code Execution Vulnerability", "description": "Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.\n", "references": ["https://github.com/shopware5/shopware/commit/8f6a7cefcba7547276892b82f64e4874c1a0dfed", "https://community.shopware.com/_detail_2015.html", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2017?category=shopware-5-en/security-updates"], "fixes": ["5.2.25"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "GHSA-7336-ghhp-f2qj", "noindex": false, "published": "2024-05-21T20:52:57Z", "modified": "2024-12-06T05:42:56.820929Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-7336-ghhp-f2qj", "title": "Shopware Remote Code Execution Vulnerability", "description": "Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware in versions prior to 5.2.16. One possible threat is if a template that doesn’t derive from the Shopware standard has been completely copied. Themes or plugins that execute or overwrite the following template code are vulnerable.\n\n- Affected file: emotion.tpl\n\nPath template file \"Emotion template\": templates / _default / frontend / forms / elements.tpl\nPath template file \"Responsive template\": themes/Frontend/Bare/frontend/forms/elements.tpl\n\nThe complete line beginning with: `{eval var=$sSupport.sFields[$sKey]...` should be exchanged with the follow", "references": ["https://github.com/shopware5/shopware/commit/6113d30a90e626154e438aa896e656c0f38694f3", "https://community.shopware.com/_detail_1989.html", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates"], "fixes": ["5.2.16"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "GHSA-jqr7-5h7r-ch8p", "noindex": false, "published": "2024-05-21T20:42:46Z", "modified": "2024-12-06T05:30:39.869511Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-jqr7-5h7r-ch8p", "title": "Shopware Non-Persistent XSS in the Frontend", "description": "A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.", "references": ["https://github.com/shopware5/shopware/commit/54461aa651566dc2701b873fe6bd94589604751b", "https://community.shopware.com/_detail_2048.html", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2018?category=shopware-5-en/security-updates"], "fixes": ["5.3.7"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "GHSA-q3g4-2vw9-xv27", "noindex": false, "published": "2024-05-21T18:50:07Z", "modified": "2024-12-06T05:38:17.931613Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-q3g4-2vw9-xv27", "title": "Shopware Remote Code Execution Vulnerability", "description": "Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware. This is a critical security vulnerability that could affect the entire system. All Shopware versions including Shopware 5.2.14 are affected.\n", "references": ["https://github.com/shopware5/shopware/commit/14299e9ee9f7d93f687b4ec838e0873afbc84fec", "https://community.shopware.com/_detail_1989.html", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2017?category=shopware-5-en/security-updates"], "fixes": ["1.0.8", "5.2.15"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}, {"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-34099", "noindex": false, "published": "2023-06-27T16:29:07.220Z", "modified": "2024-11-07T17:03:59.129Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00649, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-34099", "title": "Improper mail validation in Shopware", "description": "Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5", "https://github.com/shopware5/shopware/commit/39cc714d9a0be33b43877044d0b88ea3c6b43f3d", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023"], "fixes": ["5.7.18"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-34098", "noindex": false, "published": "2023-06-27T16:25:15.157Z", "modified": "2024-11-07T17:05:23.474Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00611, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-34098", "title": "Dependency configuration exposed in Shopware", "description": "Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.\n", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9", "https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023"], "fixes": ["5.7.18"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-48150", "noindex": false, "published": "2023-04-21T00:00:00.000Z", "modified": "2025-02-05T14:48:21.977Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0058, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-48150", "title": "CVE-2022-48150", "description": "Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.", "references": ["https://github.com/sahilop123/-CVE-2022-48150", "https://nvd.nist.gov/vuln/detail/CVE-2022-48150"], "fixes": [], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-36102", "noindex": false, "published": "2022-09-12T20:00:24.000Z", "modified": "2025-04-23T17:12:08.264Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00798, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-36102", "title": "Acess control list bypassed via crafted specific URLs", "description": "Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.", "references": ["https://packagist.org/packages/shopware/shopware", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-09-2022", "https://github.com/shopware/shopware/security/advisories/GHSA-qc43-pgwq-3q2q"], "fixes": ["5.7.15"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-36101", "noindex": false, "published": "2022-09-12T20:00:16.000Z", "modified": "2025-04-23T17:12:13.936Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00697, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-36101", "title": "Sensitive data in backend customer module", "description": "Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update either via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.", "references": ["https://packagist.org/packages/shopware/shopware", "https://github.com/shopware/shopware/security/advisories/GHSA-6vfq-jmxg-g58r", "https://github.com/shopware/shopware/commit/af5cdbc81d60f21b728e1433aeb8837f25938d2a"], "fixes": ["5.7.15"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-31148", "noindex": false, "published": "2022-08-01T17:10:12.000Z", "modified": "2025-04-23T17:56:53.899Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00693, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-31148", "title": "Persistent cross site scripting in customer module in Shopware", "description": "Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-5834-xv5q-cgfw", "https://github.com/shopware/shopware/commit/7875855005648fba7b39371a70816afae2e07daf", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022"], "fixes": ["5.7.14"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-31057", "noindex": false, "published": "2022-06-27T19:30:26.000Z", "modified": "2025-04-23T18:07:50.536Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "severity": "medium", "epss": 0.00697, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-31057", "title": "Authenticated Stored XSS in Shopware Administration", "description": "Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj", "https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022"], "fixes": ["5.7.12"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-24892", "noindex": false, "published": "2022-04-28T14:20:12.000Z", "modified": "2025-04-23T18:31:35.369Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.0087, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-24892", "title": "Multiple valid tokens for password reset in Shopware", "description": "Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.", "references": ["https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022", "https://www.shopware.com/en/changelog-sw5/#5-7-9", "https://github.com/shopware/shopware/security/advisories/GHSA-3qrq-r688-vvh4"], "fixes": ["5.7.9"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-24879", "noindex": false, "published": "2022-04-28T14:15:14.000Z", "modified": "2025-04-23T18:31:44.146Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00605, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-24879", "title": "Malfunction of Cross-Site Request Forgery token validation", "description": "Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.", "references": ["https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022", "https://www.shopware.com/en/changelog-sw5/#5-7-9", "https://github.com/shopware/shopware/security/advisories/GHSA-pf38-v6qj-j23h"], "fixes": ["5.7.9"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-24873", "noindex": false, "published": "2022-04-28T13:45:14.000Z", "modified": "2025-04-23T18:31:52.852Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00791, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-24873", "title": "Non-Stored Cross-site Scripting in Shopware storefront", "description": "Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-4g29-fccr-p59w", "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022", "https://www.shopware.com/en/changelog-sw5/#5-7-9"], "fixes": ["5.7.9"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-21652", "noindex": false, "published": "2022-01-05T19:20:18.000Z", "modified": "2025-04-23T19:14:34.905Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00792, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-21652", "title": "Insufficient Session Expiration in shopware", "description": "Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.", "references": ["https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022", "https://github.com/shopware/shopware/security/advisories/GHSA-p523-jrph-qjc6", "https://github.com/shopware/shopware/commit/47ebd126a94f4b019b6fde64c0df3d18d74ef7d0"], "fixes": ["5.7.7"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-21651", "noindex": false, "published": "2022-01-05T19:15:14.000Z", "modified": "2025-04-23T19:14:41.168Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00774, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-21651", "title": "Open redirect in shopware", "description": "Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-c53v-qmrx-93hg", "https://github.com/shopware/shopware/commit/a90046c765c57a46c4399dce17bd174253c32886", "https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022"], "fixes": ["5.7.7"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}, {"id": "CVE-2021-41188", "noindex": false, "published": "2021-10-26T15:00:16.000Z", "modified": "2024-08-04T03:08:31.242Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00761, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2021-41188", "title": "Authenticated Stored XSS in Administration", "description": "Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.", "references": ["https://github.com/shopware/shopware/security/advisories/GHSA-4p3x-8qw9-24w9", "https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58", "https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021"], "fixes": ["5.7.6"], "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}]}], "total": 34, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "shopware/shopware", "path": "vulns/packagist/shopware%2Fshopware", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["6.7.5.1", "6.7.2.1", "5.7.18", "5.7.15", "5.7.14", "5.7.12", "5.7.9", "5.7.7", "5.7.6", "5.6.10", "5.6.9", "5.5.8"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-01-14T21:15:57.391Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}