# shopware/shopware (Packagist) vulnerabilities

Source: https://junglewise.ai/threats/technologies/shopware-shopware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/shopware-shopware.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 34 vulnerabilities in shopware/shopware (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-23498, was published on 14 January 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 34 (0 critical, 0 exploited in the wild)

## About shopware/shopware (Packagist)

An open-source e-commerce platform based on Symfony and Vue.js.

## Latest shopware/shopware (Packagist) vulnerabilities

- [CVE-2026-23498: Shopware Has Improper Control of Generation of Code in Twig rendered views](https://junglewise.ai/threats/cve-2026-23498-shopware-has-improper-control-of-generation-of-code-in-twig) (low, CVSS 3.1, published 14 Jan 2026)
- [CVE-2025-67648: Shopware Storefront Reflected XSS in Storefront Login Page](https://junglewise.ai/threats/cve-2025-67648-shopware-storefront-reflected-xss-in-storefront-login-page) (high, CVSS 7.1, published 11 Dec 2025)
- [Shopware: Reflective Cross Site-Scripting (XSS) in CMS components](https://junglewise.ai/threats/shopware-reflective-cross-site-scripting-xss-in-cms-components-a33d7f04) (low, CVSS 3.1, published 10 Sep 2025)
- [Shopware Remote Code Execution Vulnerability](https://junglewise.ai/threats/shopware-remote-code-execution-vulnerability-c04cc911) (low, CVSS 3.1, published 21 May 2024)
- [Shopware Remote Code Execution Vulnerability](https://junglewise.ai/threats/shopware-remote-code-execution-vulnerability-acc424a9) (low, CVSS 3.1, published 21 May 2024)
- [Shopware Non-Persistent XSS in the Frontend](https://junglewise.ai/threats/shopware-non-persistent-xss-in-the-frontend-fbad9d6e) (low, CVSS 3.1, published 21 May 2024)
- [Shopware Remote Code Execution Vulnerability](https://junglewise.ai/threats/shopware-remote-code-execution-vulnerability-79d7747d) (low, CVSS 3.1, published 21 May 2024)
- [CVE-2023-34099: Shopware improper mail validation vulnerability](https://junglewise.ai/threats/cve-2023-34099-shopware-improper-mail-validation-vulnerability) (low, CVSS 3.1, published 28 Jun 2023)
- [CVE-2023-34098: Shopware dependency configuration exposed](https://junglewise.ai/threats/cve-2023-34098-shopware-dependency-configuration-exposed) (low, CVSS 3.1, published 28 Jun 2023)
- [CVE-2022-48150: Shopware vulnerable to cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2022-48150-shopware-vulnerable-to-cross-site-scripting-xss) (low, CVSS 3.1, published 21 Apr 2023)
- [CVE-2022-36101: Shopware contains sensitive data in backend customer module](https://junglewise.ai/threats/cve-2022-36101-shopware-contains-sensitive-data-in-backend-customer-module) (low, CVSS 3.1, published 16 Sep 2022)
- [CVE-2022-36102: Shopware access control list bypassed via crafted specific URLs](https://junglewise.ai/threats/cve-2022-36102-shopware-access-control-list-bypassed-via-crafted-specific-urls) (low, CVSS 3.1, published 16 Sep 2022)
- [CVE-2022-31148: Shopware vulnerable to persistent cross site scripting (XSS) in customer module](https://junglewise.ai/threats/cve-2022-31148-shopware-vulnerable-to-persistent-cross-site-scripting-xss-in) (low, CVSS 3.1, published 27 Jul 2022)
- [CVE-2022-31057: Authenticated Stored Cross-site Scripting in Shopware](https://junglewise.ai/threats/cve-2022-31057-authenticated-stored-cross-site-scripting-in-shopware) (low, CVSS 3.1, published 22 Jun 2022)
- [CVE-2019-12935: Shopware Cross-site Scripting Vulnerability](https://junglewise.ai/threats/cve-2019-12935-shopware-cross-site-scripting-vulnerability) (low, CVSS 3, published 24 May 2022)
- [CVE-2019-12799: Shopware Insecure Deserialization Vulnerability](https://junglewise.ai/threats/cve-2019-12799-shopware-insecure-deserialization-vulnerability) (low, CVSS 3, published 24 May 2022)
- [CVE-2017-15374: Shopware XSS Vulnerability](https://junglewise.ai/threats/cve-2017-15374-shopware-xss-vulnerability) (low, CVSS 3, published 14 May 2022)
- [CVE-2016-3109: Shopware RCE Vulnerability](https://junglewise.ai/threats/cve-2016-3109-shopware-rce-vulnerability) (low, CVSS 3, published 14 May 2022)
- [CVE-2018-20713: Shopware SQL Injection](https://junglewise.ai/threats/cve-2018-20713-shopware-sql-injection) (low, CVSS 3, published 14 May 2022)
- [CVE-2017-18357: Shopware XXE Vulnerability](https://junglewise.ai/threats/cve-2017-18357-shopware-xxe-vulnerability) (low, CVSS 3, published 14 May 2022)
- [CVE-2022-24892: Multiple valid tokens for password reset in Shopware](https://junglewise.ai/threats/cve-2022-24892-multiple-valid-tokens-for-password-reset-in-shopware) (low, CVSS 3.1, published 28 Apr 2022)
- [CVE-2022-24879: Malfunction of CSRF token validation in Shopware](https://junglewise.ai/threats/cve-2022-24879-malfunction-of-csrf-token-validation-in-shopware) (low, CVSS 3.1, published 28 Apr 2022)
- [CVE-2022-24873: Reflected Cross-site Scripting in Shopware storefront](https://junglewise.ai/threats/cve-2022-24873-reflected-cross-site-scripting-in-shopware-storefront) (low, CVSS 3.1, published 28 Apr 2022)
- [CVE-2022-21651: Open redirect in shopware](https://junglewise.ai/threats/cve-2022-21651-open-redirect-in-shopware) (low, CVSS 3.1, published 6 Jan 2022)
- [CVE-2022-21652: Insufficient Session Expiration in shopware](https://junglewise.ai/threats/cve-2022-21652-insufficient-session-expiration-in-shopware) (low, CVSS 3.1, published 6 Jan 2022)

## Most severe shopware/shopware (Packagist) vulnerabilities

- [CVE-2025-67648: Shopware Storefront Reflected XSS in Storefront Login Page](https://junglewise.ai/threats/cve-2025-67648-shopware-storefront-reflected-xss-in-storefront-login-page) (high, CVSS 7.1, published 11 Dec 2025)
- [Shopware sensitive file exposure via incorrect web root configuration](https://junglewise.ai/threats/shopware-sensitive-file-exposure-via-incorrect-web-root-configuration-ff4bd75f) (medium, CVSS 5.3, published 13 Apr 2021)
- [CVE-2021-32712: Exposure of Sensitive Information to an Unauthorized Actor](https://junglewise.ai/threats/cve-2021-32712-exposure-of-sensitive-information-to-an-unauthorized-actor) (low, CVSS 3.1, published 8 Sep 2021)
- [CVE-2022-24892: Multiple valid tokens for password reset in Shopware](https://junglewise.ai/threats/cve-2022-24892-multiple-valid-tokens-for-password-reset-in-shopware) (low, CVSS 3.1, published 28 Apr 2022)
- [CVE-2022-24873: Reflected Cross-site Scripting in Shopware storefront](https://junglewise.ai/threats/cve-2022-24873-reflected-cross-site-scripting-in-shopware-storefront) (low, CVSS 3.1, published 28 Apr 2022)
- [CVE-2022-21652: Insufficient Session Expiration in shopware](https://junglewise.ai/threats/cve-2022-21652-insufficient-session-expiration-in-shopware) (low, CVSS 3.1, published 6 Jan 2022)
- [CVE-2022-36102: Shopware access control list bypassed via crafted specific URLs](https://junglewise.ai/threats/cve-2022-36102-shopware-access-control-list-bypassed-via-crafted-specific-urls) (low, CVSS 3.1, published 16 Sep 2022)
- [CVE-2022-21651: Open redirect in shopware](https://junglewise.ai/threats/cve-2022-21651-open-redirect-in-shopware) (low, CVSS 3.1, published 6 Jan 2022)
- [CVE-2021-41188: Authenticated Stored XSS in shopware/shopware](https://junglewise.ai/threats/cve-2021-41188-authenticated-stored-xss-in-shopware-shopware) (low, CVSS 3.1, published 27 Oct 2021)
- [CVE-2021-32713: Cross-site scripting](https://junglewise.ai/threats/cve-2021-32713-cross-site-scripting) (low, CVSS 3.1, published 8 Sep 2021)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other Packagist technologies

- [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities
- [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities
- [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities
- [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities
- [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities
- [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities
- [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities
- [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities
- [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities
- [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities
- [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities
- [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "shopware/shopware (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/shopware-shopware, 9 November 2026.