UpHeron
All vulnerabilities

Servers and applications

CVE-2019-12799

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.

Severity
High 8.8
Published
13 Jun 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
54% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version up to 5.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-12799
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-12799