Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/shopware/shopware@5.0.4
purl pkg:composer/shopware/shopware@5.0.4
Next non-vulnerable version 5.3.7
Latest non-vulnerable version 6.7.6+1
Risk
Vulnerabilities affecting this package (8)
Vulnerability Summary Fixed by
VCID-bq87-fjfh-m7fx
Aliases:
CVE-2016-3109
Remote Code Execution Vulnerability Under certain conditions it is possible to execute unauthorized code in Shopware.
5.1.5
Affected by 6 other vulnerabilities.
VCID-cdn9-dp2r-fyfg
Aliases:
GMS-2017-341
Code Injection Remote Code Execution Vulnerability in shopware.
5.2.15
Affected by 8 other vulnerabilities.
VCID-ecce-958d-k3fx
Aliases:
CVE-2017-15374
Cross-site Scripting Shopware is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend.
5.3.4
Affected by 1 other vulnerability.
VCID-gn89-e5je-ybeb
Aliases:
GMS-2017-135
Remote Code Execution Vulnerability Under certain circumstances, it’s possible to execute an authorized foreign code in Shopware.
5.2.25
Affected by 3 other vulnerabilities.
VCID-k6td-39bu-dqa8
Aliases:
GMS-2017-342
Code Injection Remote Code Execution Vulnerability in shopware.
5.2.16
Affected by 5 other vulnerabilities.
VCID-mg54-375u-vfhr
Aliases:
CVE-2022-24892
GHSA-3qrq-r688-vvh4
Weak Password Recovery Mechanism for Forgotten Password Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.
5.7.9
Affected by 0 other vulnerabilities.
VCID-wh8d-hm8t-vkfm
Aliases:
GMS-2017-343
Code Injection Remote Code Execution Vulnerability in shopware.
5.2.25
Affected by 3 other vulnerabilities.
VCID-ztq4-mw67-d3g4
Aliases:
GMS-2017-106
Remote Code Execution Vulnerability Under certain circumstances, it’s possible to execute an unauthorized foreign code in Shopware.
5.2.16
Affected by 5 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-31T09:41:04.908082+00:00 GitLab Importer Affected by VCID-ecce-958d-k3fx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/CVE-2017-15374.yml 38.6.0
2026-05-31T09:38:47.408196+00:00 GitLab Importer Affected by VCID-wh8d-hm8t-vkfm https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/GMS-2017-343.yml 38.6.0
2026-05-31T09:38:41.585536+00:00 GitLab Importer Affected by VCID-gn89-e5je-ybeb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/GMS-2017-135.yml 38.6.0
2026-05-31T09:38:18.967923+00:00 GitLab Importer Affected by VCID-bq87-fjfh-m7fx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/CVE-2016-3109.yml 38.6.0
2026-05-31T09:37:46.320305+00:00 GitLab Importer Affected by VCID-k6td-39bu-dqa8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/GMS-2017-342.yml 38.6.0
2026-05-31T09:37:45.768478+00:00 GitLab Importer Affected by VCID-ztq4-mw67-d3g4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/GMS-2017-106.yml 38.6.0
2026-05-31T09:37:41.194994+00:00 GitLab Importer Affected by VCID-cdn9-dp2r-fyfg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/GMS-2017-341.yml 38.6.0
2026-05-31T00:56:00.064566+00:00 GHSA Importer Affected by VCID-mg54-375u-vfhr https://github.com/advisories/GHSA-3qrq-r688-vvh4 38.6.0
2026-05-30T20:57:46.532284+00:00 GitLab Importer Affected by VCID-mg54-375u-vfhr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/shopware/CVE-2022-24892.yml 38.6.0