PT-2024-29891 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.6.5.1 Shopware versions prior to 6.5.8.13 Description: The issue concerns a new Twig Tag sw silent feature call in Shopware, which silences deprecation messages. This tag accepts a string parameter for the feature...

Command injection

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...