https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 18:19:48 +0000 https://cve.radiocsirt.org/vuln/cve-2023-2017 <p><strong>Affected:</strong> Shopware AG Shopware 6</p> <p>Server-side Template Injection (SSTI) in Shopware 6 (&lt;= v6.4.20.0, v6.5.0.0-rc1 &lt;= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.</p> <p><strong>Affected:</strong> Shopware AG Shopware 6</p> <p>Server-side Template Injection (SSTI) in Shopware 6 (&lt;= v6.4.20.0, v6.5.0.0-rc1 &lt;= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.</p> https://cve.radiocsirt.org/vuln/cve-2023-2017