CVE-2025-67648 - CVE House

Back to Database

Status published High CVE-2025-67648

Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page

7.1 CVSS

Vulnerability Description

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php. A request parameter from the login page URL is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter, waitTime, which lacks proper input validation. This issue is fixed in versions 6.6.10.10 and 6.7.5.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67648

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from shopware

View All →

Shopware's default newsletter opt-in settings allow for mass sign-up abuse

Shopware allows Denial Of Service via password length

Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware vulnerable to blind SQL-injection in DAL aggregations

Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Affected Vendor

shopware

View all reports →

Affected Software

shopware

Vulnerable Versions:

>= 6.4.6.0, < 6.6.10.10, >= 6.7.0.0, < 6.7.5.1

Timeline

Official Publish: December 10th, 2025

Last Modified: December 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement