HTML injection possibility in voucher code form in Shopware

概要

参考情報

• shopware/platform security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2022-24746 · ADVISORY
• shopware/platform commit 651598a · WEB
• docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 · WEB
• docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2022 · WEB
• shopware/platform · PACKAGE

shopware/core のその他の脆弱性

• CVE-2026-48013中 4.1Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated…
• CVE-2026-48012中 4.3Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET …
• CVE-2026-48016中 4.3Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkou…
• CVE-2026-48015中 4.9Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed_extensions whitelist in src/Core/Framew…
• CVE-2026-48014中 6.5Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/sta…