VulertSecurity VulertSecurity

Vulnerability Database · Packagist · shopware/core · Version

shopware/core v6.7.5.0

v6.7.5.0 is affected by 15 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 3 High 4 Medium 8 Low 0 Unrated 0

All shopware/core versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

shopware/core v6.7.5.0 vulnerabilities

15 vulnerabilities cover shopware/core v6.7.5.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-22406: Blind SQL injection in shopware 9.3 critical 6.5.7.4 17 Jan 2024
CVE-2026-31887: Shopware Core and Platform Unauthenticated Data Extraction Vulnerability 8.9 high 6.7.8.1 11 Mar 2026
CVE-2024-42356: Shopware Core and Platform - Server Side Template Injection in Twig using Context functions 8.3 high 6.5.8.13 08 Aug 2024
CVE-2024-42355: Server Side Template Injection in Shopware using deprecation silence tag 8.3 high 6.5.8.13 08 Aug 2024
CVE-2021-37710: Cross-Site Scripting via SVG media files in Shopware/Core and Shopware/Platform 8.0 high 6.4.3.1 23 Aug 2021
CVE-2024-42357: Shopware Core - Blind SQL Injection in DAL Aggregations 7.3 medium 6.5.8.13 08 Aug 2024
CVE-2022-24748: Incorrect Authentication in shopware 6.8 medium 6.4.8.2 10 Mar 2022
CVE-2024-42354: Shopware Improper Access Control with ManyToMany associations in store-api 5.3 medium 6.5.8.13 08 Aug 2024
Password Reset Link Vulnerability in Shopware Core: Old Links Remain Valid After Email Change 5.0 medium 6.6.10.9 14 Nov 2025
CVE-2026-48015: Shopware Core and Platform Stored XSS via SVG File Upload 4.9 medium 6.7.10.1 04 Jun 2026
CVE-2024-22407: Broken Access Control in Shopware CMS 4.9 medium 6.5.7.4 17 Jan 2024
CVE-2026-48012: Shopware Core and Platform Open Redirect Vulnerability 4.3 medium 6.7.10.1 04 Jun 2026
CVE-2026-48013: Shopware Core and Platform SSRF Vulnerability in Media External-Link Endpoint 4.1 medium 6.7.10.1 04 Jun 2026
Webcache Poisoning in shopware/core and shopware/platform N/A critical 6.4.6.1 24 Nov 2021
Information Leak via Store-API Aggregations in shopware/core and shopware/platform N/A critical 6.3.5.3 13 Apr 2021

Looking for another version, or everything Vulert holds for shopware/core?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About shopware/core v6.7.5.0

Is shopware/core v6.7.5.0 vulnerable?

Yes. 15 vulnerabilities in the Vulert database cover shopware/core v6.7.5.0: 3 critical, 4 high, 8 medium and 0 low. Each entry above names the fixed version to move to.

How do I monitor shopware/core for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the shopware/core version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.