PT-2026-7163 · Shopware · Froshadminer+1

Gugiman + 1 · Publicado 2026-02-09 · Atualizado 2026-02-28 · CVE-2026-25878

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FroshAdminer versions prior to 2.2.1

Description The Adminer route ('/admin/adminer') within the FroshAdminer plugin for Shopware Platform was accessible without requiring Shopware admin authentication. The route was configured without authentication and session validation, potentially exposing the Adminer user interface to unauthorized users.

Recommendations Update FroshAdminer to version 2.2.1 or later.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-25878

GHSA-F339-246P-WWJP

Produtos afetados

Froshadminer

Shopware/Platform

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25878.json · Exploit
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/security/advisories/GHSA-f339-246p-wwjp · Aviso do Fabricante
• https://github.com/FriendsOfShopware/FroshPlatformAdminer · Nota
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/releases/tag/2.2.1 · Nota
• https://github.com/FriendsOfShopware/FroshPlatformAdminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b · Correção
• https://osv.dev/vulnerability/CVE-2026-25878 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2021134564303790160 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2020972045341798733 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-f339-246p-wwjp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25878 · Nota de Segurança
• https://t.me/cveNotify/153607 · Publicação no Telegram