Beveiligingsadvies

CVE-2025-67648

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-12-10 23:55:10

Laatst bijgewerkt 2025-12-11 19:00:14

Toegewezen door GitHub_M

CVSS-score 7.1

Status PUBLISHED

Beschrijving

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.

← Alle CVE's bekijken Bekijk op cve.org ↗