swag vulnerabilities

Products

• platform-security 1
• swag/paypal 1

Latest swag CVEs

Newest publication first

1. CVE-2026-32100 swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

   Published 2026-03-12

   Medium·CVSS 5.3 EPSS 0.23%

   Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.

2. CVE-2023-23941 SwagPayPal payment not sent to PayPal correctly

   Published 2023-02-03

   High·CVSS 7.5 EPSS 0.30%

   SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card), the amount and item list sent to PayPal may not be identical to the one in the created order....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.