| | | | minor | | 0007995 | 2026-08-19 | | new | 1.05. Users | Vulnerability Report : No validation of csrf on the login |
| | | | minor | | 0007994 | 2026-08-19 | | new | 1.03. Basket, checkout process | Business Logic & Input Validation Vulnerability in Cart System |
| | | | minor | | 0007311 | 2026-08-19 | | confirmed | 4.02. Session handling | User remains logged in when switching between subshobs, although "Allow users from other stores" is disabled |
| | | | minor | | 0005930 | 2026-08-19 | 2 | confirmed | 4.08. Cache | System health check should also check if folder for default cache backend on filesystem has sufficient permissions |
| | | | minor | | 0007604 | 2026-08-19 | | confirmed | 4.08. Cache | The manufacturer name in the article page doesn't change due to cache reasons |
| | | | minor | | 0007113 | 2026-08-19 | 1 | confirmed | 2.3. Extensions (modules, themes) | Module information is not deleted completely |
| | | | tweak | | 0007630 | 2026-08-18 | 1 | resolved | 1.04. Content, static (register, contact etc.) pages | After submitting the contact form, input values remain, so some people may submit the form twice |
| | | | minor | | 0004420 | 2026-08-14 | | resolved | 1.02. Price calculations (discounts, coupons, additional costs etc.) | Discount title didn't change in basket |
| | | | minor | | 0006352 | 2026-08-13 | | resolved | 1.05. Users | Validation Registration E-Mail is inconsistent |
| | | | major | | 0007990 | 2026-08-12 | | confirmed | 6. ------ Setup ------- | Metapackage requests insecure composer version during installation |
| | | | feature | | 0007770 | 2026-08-11 | 3 | resolved | 2. ----- eShop backend (admin) ----- | Cant use admin with cloudflare domain because of endless redirects |
| | | | tweak | | 0007993 | 2026-08-11 | | new | 2. ----- eShop backend (admin) ----- | Ascending and descending sort order for every admin list |
| | | | major | | 0007991 | 2026-08-10 | 1 | feedback | 2. ----- eShop backend (admin) ----- | SQL Injection via getRequestEscapedParameter() via Admin |
| | | | minor | | 0007982 | 2026-07-29 | | confirmed | 4. ------ eShop Core ------- | oe:license:add silently stores nothing on an offline (grace-expired / unlicensed) shop |
| | | | minor | | 0007973 | 2026-07-29 | 1 | confirmed | General | Demodata - several Shippingcostrules has same sorting-position |
| | | | minor | | 0005590 | 2026-07-27 | | resolved | 4.11. Image handling | oxUtilsFile does not "grow" with iPicCount-Config |
| | | | minor | | 0007950 | 2026-07-27 | | confirmed | 4.12. Subshop handling | Oxobjectsrights has not complete subshop isolation or configration possibility |
| | | | tweak | | 0007153 | 2026-07-23 | 1 | resolved | 2.1. Master Settings | Input field length for SMTP password is too small |
| | | | minor | | 0007979 | 2026-07-17 | | new | 8. --- Twig engine --- | smarty-to-twig-converter |
| | | | minor | | 0007978 | 2026-07-16 | | new | 1.05. Users | login token for admin and frontend user |
| | | | minor | | 0007968 | 2026-07-08 | 3 | feedback | 2.2. Shop settings | The assignment windows do not display any data anymore |
| | | | major | | 0007953 | 2026-07-07 | | resolved | 4.09. SEO, SEO URL | No assignment of main category possible |
| | | | minor | | 0007743 | 2026-07-01 | 1 | resolved | 4.04. Security | In case a syntax error happens while Smarty renders a plain HTML template, the already fetched output gets echoed. |
| | | | minor | | 0007967 | 2026-07-01 | 4 | acknowledged | 1.06. Search, Tags | Double-Encoded Quotes in <title> Tag (Search Results Page) - in Twig-Templates |
| | | | minor | | 0007647 | 2026-07-01 | | confirmed | General | Allow non deprecated monolog versions ("^2.9||^3.0") |
| | | | minor | 7.5.0 | 0007934 | 2026-06-17 | | resolved | 7. --- Other tools -------------- | Console Tools: oe-console commands incorrectly return exit code 0 on failure |
| | | | feature | 7.5.0 | 0007933 | 2026-06-17 | | confirmed | 7. --- Other tools -------------- | Console Tools: Incorrect output for --version |
| | | | minor | | 0007484 | 2026-06-17 | 1 | resolved | 4.12. Subshop handling | A translation error occurs after creating a new sub shop |
| | | | minor | | 0006025 | 2026-06-12 | 5 | resolved | 2.6. Administer orders | Add article to order, not article found |
| | | | major | | 0007952 | 2026-06-10 | 8 | confirmed | 4.09. SEO, SEO URL | oxparams context will be removed from stdUrl after update |
| | | | minor | | 0007956 | 2026-06-10 | | confirmed | 2.6. Administer orders | oxbillustidstatus stays 0, even with oxustidstatus is 1 |
| | | | minor | | 0007138 | 2026-06-05 | 1 | resolved | 2.5. Administer users | Deleting users won't delete user references left in other tables |
| | | | minor | | 0007880 | 2026-06-03 | | resolved | 1.02. Price calculations (discounts, coupons, additional costs etc.) | Price calculation in e-mails wrong when a % discount is applied to an order |
| | | | major | | 0007937 | 2026-05-27 | | resolved | 4.04. Security | Stored XSS via SVG upload in media-library-module (executes on direct SVG URL) |
| | | | major | | 0007938 | 2026-05-27 | | resolved | 4.04. Security | Insufficient filename validation in media-library upload (defense-in-depth) |
| | | | minor | | 0007727 | 2026-05-21 | | resolved | 4.04. Security | Increase bcrypt cost |
| | | | major | | 0007682 | 2026-05-08 | 2 | resolved | 1.02. Price calculations (discounts, coupons, additional costs etc.) | Shipping costs are charged twice |
| | | | feature | | 0006998 | 2026-05-07 | 1 | confirmed | 2.6. Administer orders | Ship Now email can only be sent in admin languages |
| | | | feature | | 0006135 | 2026-05-06 | 1 | confirmed | 1.01. Products (product, categories, manufacturer, promotions etc.) | redundant article title + varselect logic in smarty |
| | | | feature | | 0006240 | 2026-04-23 | 1 | confirmed | 4.05. Performance | Full urls are used for recources |
| | | | minor | | 0007367 | 2026-04-23 | 4 | resolved | 2.3. Extensions (modules, themes) | Recommended Composer version breaks removing of console commands |
| | | | minor | | 0007921 | 2026-04-10 | | resolved | 8. --- Twig engine --- | Extending module templates is not simple where it should be |
| | | | feature | | 0007907 | 2026-04-01 | 4 | resolved | 1.02. Price calculations (discounts, coupons, additional costs etc.) | Discount calculation differs unexpectedly |
| | | | minor | | 0007178 | 2026-03-27 | 1 | resolved | 1.01. Products (product, categories, manufacturer, promotions etc.) | empty Dropdown in CategoryList if Rootcategory has only hidden Subcats |
| | | | minor | | 0007119 | 2026-03-24 | 1 | resolved | 2.4. Administer products | WYSIWYG Editor + Mediathek - error on creating relative links |
| | | | feature | | 0006607 | 2026-03-20 | | confirmed | 1.01. Products (product, categories, manufacturer, promotions etc.) | low product stock warning should be based on product's oxremindamount instead of global sStockWarningLimit |
| | | | minor | | 0007751 | 2026-03-19 | | resolved | 2.1. Master Settings | Adding license keys via the command line: only the last key is kept |
| | | | feature | | 0007889 | 2026-03-17 | 2 | confirmed | 4.01. Database handling | The OXID migration script does not run through to the modules on a fresh OXID system. |
| | | | tweak | | 0007877 | 2026-03-16 | 2 | resolved | 7. --- Other tools -------------- | Unified namespace generator package requires `composer/composer` while `composer-runtime-api` is enough |
| | | | minor | | 0007881 | 2026-03-16 | 1 | resolved | 4.07. Source code, Test | ContentFactory bypasses module chain by using concrete Community namespace instead of Unified Namespace |
