CVE-2022-31057

Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-79

• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022Release Notes, Vendor Advisory
• https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6fPatch, Third Party Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qjThird Party Advisory
• https://packagist.org/packages/shopware/shopwareProduct, Third Party Advisory
• https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022Release Notes, Vendor Advisory
• https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6fPatch, Third Party Advisory
• https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qjThird Party Advisory
• https://packagist.org/packages/shopware/shopwareProduct, Third Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31051semantic-release is an open source npm package for automated…7.5
• CVE-2022-31052Synapse is an open source home server implementation for the…6.5
• CVE-2022-31053Biscuit is an authentication and authorization token for mic…9.8
• CVE-2022-31054Argo Events is an event-driven workflow automation framework…7.5
• CVE-2022-31055kCTF is a Kubernetes-based infrastructure for capture the fl…7.5
• CVE-2022-31056GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31058Tuleap is a Free & Open Source Suite to improve management o…7.2
• CVE-2022-31059Discourse Calendar is a calendar plugin for Discourse, an op…5.4
• CVE-2022-3106An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31060Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2022-31061GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31062### Impact A plugin public script can be used to read conten…5.3