Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| shopware/shopware(Packagist) | 0 | 5.3.4 | N/A |
CVSS Metrics
