CVE-2025-7954

Race Condition in Shopware Voucher Submission

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

We have discovered 2 live websites that are affected by CVE-2025-7954.

Run a Free Instant Scan



Affected Software

Product  Shopware
Category Ecommerce
Vulnerable Domains2 live websites (100% of Shopware install base)
Vulnerable Versions
  • from 0 through 6.6.10.4
Vulnerable Versions Count0 versions ( less than 0.1% of all versions)


Common Weakness Enumeration

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')



Details

  • Published - Aug 6, 2025
  • Updated - Nov 3, 2025

Credits

  • Timo Müller (finder)

Website Distribution by Country

Number of websites using CVE-2025-7954
Germany2 websites

Website Distribution by TLD

Number of websites using CVE-2025-7954
.de2 websites

Websites affected by CVE-2025-7954

Top websites that are affected by CVE-2025-7954. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.de Germany**,***,***
**********.de Germany**,***,***
See full domain list

FAQ

CVE-2025-7954 is Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Shopware
A total of 2 websites have been identified as vulnerable to CVE-2025-7954, based on global website indexing conducted by WebTechSurvey.
The Shopware is affected by the CVE-2025-7954 vulnerability.
Shopware versions up to and including 6.6.10.4 are vulnerable to CVE-2025-7954.