CVE-2017-15374
mediumpriority · track · 36EPSS 0.048 · 92 %ileexploit · PoCEUUSEPSS · scored 2026-10-27
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- EDB-43849Shopware 5.2.5/5.3 - Cross-Site ScriptingPoC · exploit_db
affected products (26)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-mvrx-cmqw-2jgjShopware XSS Vulnerability2022-05-14ghsa · osvUS
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://www.vulnerability-lab.com/get_content.php?id=1922cnnvd
- https://www.exploit-db.com/exploits/43849/enisa_euvd
- https://www.vulnerability-lab.com/get_content.php?id=1922enisa_euvd
- https://www.exploit-db.com/exploits/43849/nvd
- https://www.vulnerability-lab.com/get_content.php?id=1922ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan