Vulnerability Database · Packagist · shopware/core · Version
shopware/core 6.4.20.1
6.4.20.1 is affected by 8 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 1 High 2 Medium 5 Low 0 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
shopware/core 6.4.20.1 vulnerabilities
8 vulnerabilities cover shopware/core 6.4.20.1. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2024-22406: Blind SQL injection in shopware | 9.3 critical | 6.5.7.4 | 17 Jan 2024 |
| CVE-2024-42356: Shopware Core and Platform - Server Side Template Injection in Twig using Context functions | 8.3 high | 6.5.8.13 | 08 Aug 2024 |
| CVE-2024-42355: Server Side Template Injection in Shopware using deprecation silence tag | 8.3 high | 6.5.8.13 | 08 Aug 2024 |
| CVE-2024-42357: Shopware Core - Blind SQL Injection in DAL Aggregations | 7.3 medium | 6.5.8.13 | 08 Aug 2024 |
| CVE-2024-42354: Shopware Improper Access Control with ManyToMany associations in store-api | 5.3 medium | 6.5.8.13 | 08 Aug 2024 |
| CVE-2024-31447: Shopware Improper Session Handling in store-api account logout | 5.3 medium | 6.5.8.8 | 08 Apr 2024 |
| Password Reset Link Vulnerability in Shopware Core: Old Links Remain Valid After Email Change | 5.0 medium | 6.6.10.9 | 14 Nov 2025 |
| CVE-2024-22407: Broken Access Control in Shopware CMS | 4.9 medium | 6.5.7.4 | 17 Jan 2024 |
Looking for another version, or everything Vulert holds for shopware/core?
Questions
About shopware/core 6.4.20.1
Is shopware/core 6.4.20.1 vulnerable?
Yes. 8 vulnerabilities in the Vulert database cover shopware/core 6.4.20.1: 1 critical, 2 high, 5 medium and 0 low. Each entry above names the fixed version to move to.
How do I monitor shopware/core for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the shopware/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.