Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 65
Reset filtersShopware: Stored XSS via SVG file upload — no SVG sanitization
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Shopware SSO referer trust leading to an arbitrary redirect target
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Shopware vulnerable to a potential take over of app credentials
Shopware has user enumeration via distinct error codes on Store API login endpoint
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Shopware Has Improper Control of Generation of Code in Twig rendered views
Shopware 6's password recovery link does not expire after email change
Shopware Customer Orders can be canceled, even if refunds are disabled
Shopware exposes sensitive user information via CSV export mapping
Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
Shopware vulnerable to path traversal via Plugin upload
Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components
Shopware default newsletter opt-in settings allow for mass sign-up abuse
Shopware Broken ACL on Document retrieval to access other customers documents
Shopware Vulnerable to Blind SQL-injection in DAL aggregations
Shopware allows Denial Of Service via password length
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.