Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Shopware Administration Panel Can Be Hacked via Stored Malicious Code
published 5 years ago
Summary
The Shopware administration panel can be hacked by an attacker who has logged in and added malicious code to the system. This could allow the attacker to take control of the shop and steal sensitive information. To fix this, update to the latest version of Shopware or install a security plugin to patch the issue.
What to do
- Update shopware shopware to version 5.6.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | shopware | shopware |
<= 5.6.9 Fix: upgrade to 5.6.10
|
Original advisory text
Authenticated Stored XSS in Administration
### Impact
Authenticated Stored XSS in Administration
### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Authenticated Stored XSS in Administration
### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published21 May 2021
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-f6p7-8xfw-fjqq · GHSA
Track software like this
Free during beta