Sploitus

54 exploited vulnerabilities in Shopware

Showing 1–50 of 54, highest-scoring first

Vendors
Shopware, Git, Packagist, Redis, Symfony
With known exploits
54
Affected Shopware versions
≤ 5.1.4, 5.6.0, 6.7.6.1, 5.3.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.2.14, 5.2.15, 5.2.16, 5.2.17, 5.2.18, 5.2.19, 5.2.20, 5.2.21, 5.2.22, 5.2.23, 5.2.24, 5.2.25, 5.2.26, 5.2.27, 5.3.0

Vulnerabilities with exploits

Highest CVSS first — 5 of these already have exploit code on Sploitus

CVE-2016-3109 1 exploit
CVSS 10.0 CRITICAL 2017-04-21FIX AVAILABLE
Shopware Server Side Template Injection RCE
CVE-2023-22731
CVSS 9.9 CRITICAL 2023-01-17FIX AVAILABLE
CVE-2024-22406
CVSS 9.3 CRITICAL 2024-01-16FIX AVAILABLE
CVE-2026-31889
CVSS 8.9 HIGH 2026-03-11FIX AVAILABLE
CVE-2026-31887
CVSS 8.9 HIGH 2026-03-11FIX AVAILABLE
CVE-2019-12799 1 exploit
CVSS 8.8 HIGH 2019-06-13FIX AVAILABLE
Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE
CVE-2024-42356
CVSS 8.7 HIGH 2024-08-08FIX AVAILABLE
CVE-2024-42355
CVSS 8.7 HIGH 2024-08-08FIX AVAILABLE
CVE-2022-24872
CVSS 8.1 HIGH 2022-04-20FIX AVAILABLE
CVE-2024-22408
CVSS 7.6 HIGH 2024-01-16FIX AVAILABLE
CVE-2025-30151
CVSS 7.5 HIGH 2025-04-08FIX AVAILABLE
CVE-2024-27917
CVSS 7.5 HIGH 2024-03-06FIX AVAILABLE
CVE-2022-24879
CVSS 7.5 HIGH 2022-04-28FIX AVAILABLE
CVE-2019-12935
CVSS 7.4 HIGH 2019-06-23FIX AVAILABLE
CVE-2024-42357
CVSS 7.3 HIGH 2024-08-08FIX AVAILABLE
CVE-2026-23498 1 exploit
CVSS 7.2 HIGH 2026-01-14FIX AVAILABLE
📄 Shopware Improper Control
CVE-2022-24871
CVSS 7.2 HIGH 2022-04-20FIX AVAILABLE
CVE-2025-67648
CVSS 7.1 HIGH 2025-12-10FIX AVAILABLE
CVE-2025-32378
CVSS 6.9 MEDIUM 2025-04-09FIX AVAILABLE
CVE-2026-48009
CVSS 6.8 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2025-27892
CVSS 6.8 MEDIUM 2025-04-08FIX AVAILABLE
CVE-2022-24892
CVSS 6.8 MEDIUM 2022-04-28FIX AVAILABLE
CVE-2022-24748
CVSS 6.8 MEDIUM 2022-03-09FIX AVAILABLE
CVE-2022-21651
CVSS 6.8 MEDIUM 2022-01-05FIX AVAILABLE
CVE-2026-48014
CVSS 6.5 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2026-48010
CVSS 6.5 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2026-48008
CVSS 6.5 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2022-31057
CVSS 6.5 MEDIUM 2022-06-22FIX AVAILABLE
CVE-2017-18357 5 exploits
CVSS 6.5 MEDIUM 2019-01-15FIX AVAILABLE
Shopware - createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execute ExploitShopware - createInstanceFromNamedArguments PHP Object Instantiation Remote Code Execution (Metasploit)
CVE-2023-22730
CVSS 6.3 MEDIUM 2023-01-17FIX AVAILABLE
CVE-2022-36102
CVSS 6.3 MEDIUM 2022-09-12FIX AVAILABLE
CVE-2022-24747
CVSS 6.3 MEDIUM 2022-03-09FIX AVAILABLE
CVE-2022-48150
CVSS 6.1 MEDIUM 2023-04-21
CVE-2022-24746
CVSS 6.1 MEDIUM 2022-03-09FIX AVAILABLE
CVE-2017-15374 6 exploits
CVSS 6.1 MEDIUM 2017-10-16FIX AVAILABLE
Shopware 5.2.55.3 - Cross-Site ScriptingShopware 5.2.5/5.3 - Cross-Site Scripting
CVE-2024-42354
CVSS 5.9 MEDIUM 2024-08-08FIX AVAILABLE
CVE-2022-24745
CVSS 5.8 MEDIUM 2022-03-09FIX AVAILABLE
CVE-2022-21652
CVSS 5.5 MEDIUM 2022-01-05FIX AVAILABLE
CVE-2022-36101
CVSS 5.4 MEDIUM 2022-09-12FIX AVAILABLE
CVE-2022-31148
CVSS 5.4 MEDIUM 2022-07-27FIX AVAILABLE
CVE-2022-24873
CVSS 5.4 MEDIUM 2022-04-28FIX AVAILABLE
CVE-2026-31888
CVSS 5.3 MEDIUM 2026-03-11FIX AVAILABLE
CVE-2023-34099
CVSS 5.3 MEDIUM 2023-06-27FIX AVAILABLE
CVE-2023-34098
CVSS 5.3 MEDIUM 2023-06-27FIX AVAILABLE
CVE-2026-48015
CVSS 4.9 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2024-22407
CVSS 4.9 MEDIUM 2024-01-16FIX AVAILABLE
CVE-2026-48016
CVSS 4.3 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2026-48012
CVSS 4.3 MEDIUM 2026-06-04FIX AVAILABLE
CVE-2023-22734
CVSS 4.3 MEDIUM 2023-01-17FIX AVAILABLE
CVE-2026-48013
CVSS 4.1 MEDIUM 2026-06-04FIX AVAILABLE