Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

22 results

Apr 9, 2025Shopware is an open source e-commerce software platform.CVE-2025-32378 · Other software · shopware · reported by GitHubMedium 6.9
Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 29, 2024Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Algoritim E-commerce Software allows Reflected XSS.CVE-2023-6047 · Websites & servers · Algoritim · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Algoritim E-commerce Software allows Reflected XSS. This issue affects E-commerce Software: before 3.9.2.
Product
E-commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Dec 29, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-CommerCVE-2023-4674 · Websites & servers · Yaztek Software Technologies and Computer Systems · reported by iletisim@usom.gov.tr
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Nov 23, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS.CVE-2023-4406 · Websites & servers · KC Group · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Sep 5, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection.CVE-2023-4531 · Websites & servers · Mestav Software · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .
Product
E-commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Aug 8, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Stored XSS.CVE-2023-3653 · Websites & servers · Digital Ant · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Stored XSS. This issue affects E-Commerce Software: before 11.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Aug 8, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS.CVE-2023-3652 · Websites & servers · Digital Ant · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital Ant E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: before 11.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Aug 8, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection.CVE-2023-3651 · Websites & servers · Digital Ant · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Aug 8, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection.CVE-2023-3898 · Websites & servers · mAyaNet · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.
Product
E-Commerce Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jun 27, 2023Shopware is an open source e-commerce software.CVE-2023-34099 · Other software · shopware · reported by GitHubMedium 5.3
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Jun 27, 2023Shopware is an open source e-commerce software.CVE-2023-34098 · Other software · shopware · reported by GitHubMedium 5.3
Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Javascript could be read in production environments (`themes/package-lock.json`). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Sep 12, 2022Shopware is an open source e-commerce software.CVE-2022-36102 · Other software · shopware · reported by GitHubMedium 6.3
Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Sep 12, 2022Shopware is an open source e-commerce software.CVE-2022-36101 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software. In affected versions the request for the customer detail view in the backend administration contained sensitive data like the hashed password and the session ID. These fields are now explicitly unset in version 5.7.15. Users are advised to update and may get the update either via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Aug 1, 2022Shopware is an open source e-commerce software.CVE-2022-31148 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Users are recommend to update to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Jun 27, 2022Shopware is an open source e-commerce software made in Germany.CVE-2022-31057 · Other software · shopware · reported by GitHubMedium 6.5
Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24892 · Other software · shopware · reported by GitHubMedium 6.4
Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take over the victim's account if they somehow gain access to the victims email account and find an unused password reset token in the emails. This issue is fixed in version 5.7.9.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24879 · Other software · shopware · reported by GitHubHigh 7.5
Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token validation. Under certain circumstances, the CSRF tokens were not generated anew and not validated correctly. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Apr 28, 2022Shopware is an open source e-commerce software platform.CVE-2022-24873 · Other software · shopware · reported by GitHubMedium 5.4
Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerability by using the Shopware security plugin.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Jan 5, 2022Shopware is an open source e-commerce software platform.CVE-2022-21652 · Other software · shopware · reported by GitHubLow 3.5
Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. With version 5.7.7 the session validation was adjusted, so that sessions created prior to the latest password change of a customer account can't be used to login with said account. This also means, that upon a password change, all existing sessions for a given customer account are automatically considered invalid. There is no workaround for this issue.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Jan 5, 2022Shopware is an open source e-commerce software platform.CVE-2022-21651 · Other software · shopware · reported by GitHubMedium 6.8
Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplete URL handling in the shopware router. This issue has been resolved in version 5.7.7. There is no workaround and users are advised to upgrade as soon as possible.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Oct 26, 2021Shopware is open source e-commerce software.CVE-2021-41188 · Other software · shopware · reported by GitHubMedium 5.7
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability.
Product
shopware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.shopware.com github.com
Aug 26, 2019laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.CVE-2019-15489 · Other software · Laracom · reported by MITREMedium 6.1
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.
Product
Laracom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.