CVE-2017-15374

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.

• CWE-79

• https://www.exploit-db.com/exploits/43849/
• https://www.vulnerability-lab.com/get_content.php?id=1922Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/43849/
• https://www.vulnerability-lab.com/get_content.php?id=1922Exploit, Third Party Advisory

Published

Oct 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15368The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare…
• CVE-2017-15369The build_filter_chain function in pdf/pdf-stream.c in Artif…
• CVE-2017-15370There is a heap-based buffer overflow in the ImaExpandS func…
• CVE-2017-15371There is a reachable assertion abort in the function sox_app…
• CVE-2017-15372There is a stack-based buffer overflow in the lsx_ms_adpcm_b…
• CVE-2017-15373E-Sic 1.0 allows SQL injection via the q parameter to esicli…
• CVE-2017-15375Multiple client-side cross site scripting vulnerabilities ha…
• CVE-2017-15376The TELNET service in Mobatek MobaXterm 10.4 does not requir…9.8
• CVE-2017-15377In Suricata before 4.x, it was possible to trigger lots of r…
• CVE-2017-15378SQL Injection exists in the E-Sic 1.0 password reset paramet…
• CVE-2017-15379An authentication bypass exists in the E-Sic 1.0 /index (aka…
• CVE-2017-1538IBM Financial Transaction Manager for ACH Services for Multi…