News · via CERT/CC
VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution…