Shopware 6

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions2
First seenAug 25, 2026
Last mentioned17d ago

Timeline

2 articles · newest first

VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

CERT/CC warns a Shopware 6 stored XSS can steal admin tokens and enable code execution, with no patch.

CERT/CC Vulnerability NotesOct 13, 18:14 UTC · 17d agoVulnerabilityCVE-2026-1049372 · 1 read

Shopware fixes Store API vulnerability allowing administrator takeover

Sansec discovered a Shopware 6 Store API flaw enabling administrator takeover; merchants should immediately update to 6.7.13.1 or 6.6.10.23.

Sansec (Magento / e-commerce security)Aug 25, 00:00 UTC · Aug 25, 2026Vulnerability1

Related CVEs

by mentions

CVE-2026-1049378.1
Stored XSS in Shopware 6.7 can steal admin tokens and lead to RCE
published 17d agoShopware

Appears with

Shopwarevendor · 2
CERT/CCorganization · 1
Sansecvendor · 1

Entities are extracted by the model from each article. First seen Aug 25, 2026, last mentioned 17d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.