Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
Published June 24, 2019.
Shopware Shopware