UpHeron
All vulnerabilities

Servers and applications

CVE-2025-67648

Reflected XSS in Storefront Login Page

Severity
Medium 6.1
Published
9 Dec 2025
Last changed
14 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.6.10.10, 6.7.5.1
Also known as
GHSA-6w82-v552-wjw2
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • From 6.4.6.0 before 6.6.10.10
  • From 6.7.0.0 before 6.7.5.1
ShopwareServers and applications · github:shopware/shopware
  • From 6.7.0.0 before 6.7.5.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-67648
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-67648
  • GitHub Advisory Database https://github.com/advisories/GHSA-6w82-v552-wjw2
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-6w82-v552-wjw2