| 0 |
|
| 1 |
|
| 2 |
| url |
VCID-637f-zxjb-8ufn |
| vulnerability_id |
VCID-637f-zxjb-8ufn |
| summary |
Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The "not found" response also echoes the probed email address. This allows an unauthenticated attacker to enumerate valid customer accounts. The storefront login controller correctly unifies both error paths, but the Store API does not — indicating an inconsistent defense. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31888 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00055 |
| scoring_system |
epss |
| scoring_elements |
0.17474 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00055 |
| scoring_system |
epss |
| scoring_elements |
0.17628 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00055 |
| scoring_system |
epss |
| scoring_elements |
0.17654 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00055 |
| scoring_system |
epss |
| scoring_elements |
0.17636 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31888 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-31888, GHSA-gqc5-xv7m-gcjq
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-637f-zxjb-8ufn |
|
| 3 |
| url |
VCID-6tys-6s4d-fqcm |
| vulnerability_id |
VCID-6tys-6s4d-fqcm |
| summary |
Shopware Broken ACL on Document retrieval to access other customers documents
### Impact
It's possible to guess the deepLinkCode of an Document to open documents of other customers
### Patches
Update to Shopware 6.6.10.3 or 6.5.8.17
### Workarounds
For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-68wv-g3fw-pq7q
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6tys-6s4d-fqcm |
|
| 4 |
|
| 5 |
| url |
VCID-dqba-4hk6-eud2 |
| vulnerability_id |
VCID-dqba-4hk6-eud2 |
| summary |
Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based authentication without sufficiently binding a shop installation to its original domain. During re‑registration, the shop-url could be updated without proving control over the previously registered shop or domain. This made targeted hijacking of app communication feasible if an attacker possessed the relevant app‑side secret. By abusing app re‑registration, an attacker could redirect app traffic to an attacker‑controlled domain and potentially obtain API credentials intended for the legitimate shop. This vulnerability is fixed in 6.6.10.15 and 6.7.8.1. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31889 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26177 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26375 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.2639 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26378 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31889 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-31889, GHSA-c4p7-rwrg-pf6p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dqba-4hk6-eud2 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
| url |
VCID-sq4j-drbr-fub6 |
| vulnerability_id |
VCID-sq4j-drbr-fub6 |
| summary |
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-30151 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00796 |
| scoring_system |
epss |
| scoring_elements |
0.74498 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00796 |
| scoring_system |
epss |
| scoring_elements |
0.74495 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00796 |
| scoring_system |
epss |
| scoring_elements |
0.74411 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00796 |
| scoring_system |
epss |
| scoring_elements |
0.74484 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-30151 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-30151, GHSA-cgfj-hj93-rmh2
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sq4j-drbr-fub6 |
|
| 10 |
| url |
VCID-stdp-p5h7-3kg3 |
| vulnerability_id |
VCID-stdp-p5h7-3kg3 |
| summary |
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-30150 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00619 |
| scoring_system |
epss |
| scoring_elements |
0.70601 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00619 |
| scoring_system |
epss |
| scoring_elements |
0.70604 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00808 |
| scoring_system |
epss |
| scoring_elements |
0.74708 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00808 |
| scoring_system |
epss |
| scoring_elements |
0.74636 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-30150 |
|
| 1 |
| reference_url |
https://github.com/shopware/shopware |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
5.5 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/shopware/shopware |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-30150, GHSA-hh7j-6x3q-f52h
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-stdp-p5h7-3kg3 |
|
| 11 |
| url |
VCID-u41w-g79s-eyez |
| vulnerability_id |
VCID-u41w-g79s-eyez |
| summary |
Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-27892 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01246 |
| scoring_system |
epss |
| scoring_elements |
0.79772 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.01246 |
| scoring_system |
epss |
| scoring_elements |
0.79784 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.01246 |
| scoring_system |
epss |
| scoring_elements |
0.7979 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.01246 |
| scoring_system |
epss |
| scoring_elements |
0.79707 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-27892 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-27892, GHSA-8g35-7rmw-7f59
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u41w-g79s-eyez |
|
| 12 |
| url |
VCID-ykq7-2fy3-b7e1 |
| vulnerability_id |
VCID-ykq7-2fy3-b7e1 |
| summary |
Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-32378 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00441 |
| scoring_system |
epss |
| scoring_elements |
0.63782 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00441 |
| scoring_system |
epss |
| scoring_elements |
0.63668 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00441 |
| scoring_system |
epss |
| scoring_elements |
0.6377 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00441 |
| scoring_system |
epss |
| scoring_elements |
0.63783 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-32378 |
|
| 1 |
| reference_url |
https://github.com/shopware/shopware |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
|
| 1 |
| value |
2.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U |
|
| 2 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/shopware/shopware |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m |
| reference_id |
GHSA-4h9w-7vfp-px8m |
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
|
| 1 |
| value |
LOW |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
2.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U |
|
| 3 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 4 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 5 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-09T17:32:57Z/ |
|
|
| url |
https://github.com/shopware/shopware/security/advisories/GHSA-4h9w-7vfp-px8m |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-32378, GHSA-4h9w-7vfp-px8m
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ykq7-2fy3-b7e1 |
|
| 13 |
| url |
VCID-zhxv-e8fu-tucd |
| vulnerability_id |
VCID-zhxv-e8fu-tucd |
| summary |
Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31887 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0005 |
| scoring_system |
epss |
| scoring_elements |
0.16072 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.0005 |
| scoring_system |
epss |
| scoring_elements |
0.1605 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.0005 |
| scoring_system |
epss |
| scoring_elements |
0.15931 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.0005 |
| scoring_system |
epss |
| scoring_elements |
0.16084 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-31887 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-31887, GHSA-7vvp-j573-5584
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zhxv-e8fu-tucd |
|