CVE-2019-12935: Shopware Cross-site Scripting Vulnerability

The vulnerability stems from unescaped output of query string parameters in backend login handlers. While no patch diffs are available, the consistent references to backend/Login and backend/Login/load endpoints across all vulnerability descriptions indicate the controller actions handling these routes are the injection points. These controller methods would process the request parameters and pass them to views without proper sanitization in vulnerable versions (<5.5.8). The XSS payloads shown in Netsparker's examples demonstrate direct reflection of unsanitized query parameters in HTML responses.