CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2025-30150 – Shopware 6 allows attackers to check for registered accounts through the store-api
https://notcve.org/view.php?id=CVE-2025-30150
08 Apr 2025 — Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. • https://github.com/shopware/shopware/security/advisories/GHSA-hh7j-6x3q-f52h • CWE-204: Observable Response Discrepancy •
CVSS: 7.5EPSS: %CPEs: 3EXPL: 0CVE-2025-30151 – Shopware allows Denial Of Service via password length
https://notcve.org/view.php?id=CVE-2025-30151
08 Apr 2025 — Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. • https://github.com/shopware/shopware/security/advisories/GHSA-cgfj-hj93-rmh2 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-42357 – Shopware vulnerable to blind SQL-injection in DAL aggregations
https://notcve.org/view.php?id=CVE-2024-42357
08 Aug 2024 — Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the `aggregations` object. The `name` field in this `aggregations` object is vulnerable SQL-injection and can be exploited using SQL parameters. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patc... • https://github.com/shopware/core/commit/63c05615694790f5790a04ef889f42b764fa53c9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-42356 – Shopware vulnerable to Server Side Template Injection in Twig using Context functions
https://notcve.org/view.php?id=CVE-2024-42356
08 Aug 2024 — Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. The function can be called also from Twig and as the second parameter allows any callable, it's possible to call from Twig any statically callable PHP function/method. It's not possib... • https://github.com/shopware/core/commit/04183e0c02af3b404eb7d52c683734bfe0595038 • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2024-42355 – Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
https://notcve.org/view.php?id=CVE-2024-42355
08 Aug 2024 — Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. • https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-42354 – Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
https://notcve.org/view.php?id=CVE-2024-42354
08 Aug 2024 — Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default... • https://github.com/shopware/core/commit/a784aa1cec0624e36e0ee4d41aeebaed40e0442f • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-31447 – Shopware has Improper Session Handling in store-api
https://notcve.org/view.php?id=CVE-2024-31447
08 Apr 2024 — Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are u... • https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77 • CWE-613: Insufficient Session Expiration •