CVE-2025-7954

6.0 mediumEPSS 0.4%

Medium (6.0) in shopware shopware. EPSS 0.4% chance of exploitation in the next 30 days.

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-362
Published: 2025-08-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

shopware:shopware

References

https://github.com/shopware/shopware/issues/11245
http://seclists.org/fulldisclosure/2025/Aug/17
https://github.com/shopware/shopware/issues/11245

Check your stack JSON