CVE-2025-51541

MEDIUM EPSS 28.4%

Published Aug 5, 202510mo ago · Modified Jun 17, 20261w ago

6.1 CVSS 3.1

Medium

Published Aug 5, 2025 10mo ago

Last Modified Jun 17, 2026 1w ago

Description

A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution.

CVSS Details

Base Score

6.1

Exploitability

2.8

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

28.4% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
shopware	shopware	*	≥6.1.0 – <6.2.3

References 2

gist.github.com https://gist.github.com/anonx-hunter/a7ef32a01d7d888413b08bf8589fdd7e#file-cve-2025-51541-shopware-xss-md

ExploitThird Party Advisory
dax-tokaido.com https://www.dax-tokaido.com/recovery/install/database-configuration/

Not Applicable

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.