.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.0.10 vulnerabilities

360 advisories known · magento/community-edition@2.0.10 · 167 affect this release · Dependencies not checked · showing 100 more

SEVERITYADVISORYPUBLISHED

Affects 2.0.10

SEVERITYADVISORYPUBLISHED

MediumMagento stored cross-site scripting vulnerability in the customer address upload featureGHSA-8gfq-m4cf-w975CVE-2021-36026Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento allows incorrect authorizationGHSA-r355-75hw-r8jfCVE-2025-54265Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-wcmw-8xpp-rwfjCVE-2025-49558Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Insufficient Session ExpirationGHSA-4h3p-63x6-vwg2BIT-magento-2021-21031CVE-2021-21031Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Insufficient Session ExpirationGHSA-4jfq-f8hc-775qBIT-magento-2021-21032CVE-2021-21032Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-469f-wf4f-3jjvCVE-2025-24437Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-mm87-rrqx-94crCVE-2025-24428Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-xc5p-773w-m3pmBIT-magento-2024-45131CVE-2024-45131Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-qpp7-742q-58j3BIT-magento-2024-45128CVE-2024-45128Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Path Traversal vulnerabilityGHSA-7gpv-xrjr-f5h4BIT-magento-2021-28584CVE-2021-28584Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Stored cross-site scriptingGHSA-45h4-6gcj-6hwvBIT-magento-2020-9584CVE-2020-9584Affected <2.2.12, >=2.3.0 <2.3.4-p2Fixed in 2.2.12 Fixed in 2.3.4-p2OSV source ↗4 years ago

MediumMagento vulnerable to path traversalGHSA-h4f4-gv6h-x824CVE-2025-49559Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Improper Access Control leads to security feature bypassGHSA-g2pj-xmxq-3r9qCVE-2025-27206Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

MediumMagento Improper Access Control leads to Security feature bypassGHSA-6wq7-cg9h-mj6qCVE-2025-27190Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Improper Access Control leads to Security feature bypassGHSA-vhcq-4xrm-2cr2CVE-2025-27191Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Business Logic Error vulnerabilityGHSA-6ff8-jrfg-43hhCVE-2025-24425Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-w3p2-pc3h-69wvBIT-magento-2024-45124CVE-2024-45124Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Incorrect Authorization vulnerabilityGHSA-p6h9-gx5g-wg64BIT-magento-2024-34106CVE-2024-34106Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-r7cm-g469-wm4gBIT-magento-2024-34107CVE-2024-34107Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Improper input validation vulnerabilityGHSA-c38m-9668-6j2wBIT-magento-2021-28585CVE-2021-28585Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Insecure Direct Object Reference (IDOR) in the product moduleGHSA-8pfq-g48p-x7w8BIT-magento-2021-21022CVE-2021-21022Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento improper authorization vulnerability in the integrations moduleGHSA-crjc-2v9m-8w7rBIT-magento-2021-21026CVE-2021-21026Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento Improper Access ControlGHSA-2j6v-829g-885qBIT-magento-2021-21020CVE-2021-21020Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerability in the customers moduleGHSA-cc3w-r3w8-hfh7BIT-magento-2021-28567CVE-2021-28567Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Open Source Server-Side Request Forgery (SSRF) vulnerabilityGHSA-g9fm-wc6h-pvgjCVE-2024-45119Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento incorrect permissions vulnerability in the Integrations componentGHSA-hvf5-4jr9-fghhBIT-magento-2020-24402CVE-2020-24402Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-pcrx-r49h-x2w5CVE-2025-54266Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Open Source stored Cross-Site Scripting (XSS) vulnerabilityGHSA-c89g-gq5r-2xw2BIT-magento-2024-45127CVE-2024-45127Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Scripting (XSS) vulnerabilityGHSA-5632-wq7m-gfq9BIT-magento-2024-34105CVE-2024-34105Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento stored cross-site scripting vulnerability in the admin consoleGHSA-h5rm-m772-6qcxBIT-magento-2021-21023CVE-2021-21023Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Reflected Cross-site Scripting vulnerability via 'file' parameterGHSA-jwxh-wj79-ccm6BIT-magento-2021-21029CVE-2021-21029Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento Security feature bypassGHSA-8hcx-xvww-6c6hCVE-2025-49550Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

MediumMagento Improper Authorization vulnerabilityGHSA-rr2g-rrjj-xw86CVE-2025-27188Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-p1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-82p4-55gj-956pCVE-2025-24435Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-ghpr-6qhr-rpp8CVE-2025-24436Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Incorrect Authorization vulnerabilityGHSA-v6r2-425c-hfrrCVE-2025-24421Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-2qhq-fw98-h6wgCVE-2024-45121Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-46fm-x82m-5f74CVE-2024-45122Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-47jp-46c9-25vfCVE-2024-45120Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-m58h-998x-66f3BIT-magento-2024-45129CVE-2024-45129Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-v3v6-jfvw-m576BIT-magento-2024-45130CVE-2024-45130Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Incorrect Authorization vulnerabilityGHSA-xg36-8c2v-jpxhBIT-magento-2024-45125CVE-2024-45125Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-4323-f82v-f6jrCVE-2024-39410Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery vulnerabilityGHSA-4cj6-f32v-6hgxCVE-2024-39408Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xgg-rw35-7mv5CVE-2024-39416Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xmj-f664-hv98CVE-2024-39417Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-7472-vw39-g2j3CVE-2024-39412Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-74w7-cr4v-wf2vCVE-2024-39419Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization Leading to Security feature bypassGHSA-gj93-84g5-mcjqCVE-2024-39415Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to security feature bypassGHSA-qm77-mqf3-fmhqCVE-2024-39411Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-rf4q-m23c-7q8rCVE-2024-39409Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Access Control Leads to Privilege escalationGHSA-x6f9-hv9r-fgq4CVE-2024-39414Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento cross-site request forgery (CSRF) vulnerability via the GraphQL APIGHSA-h4xc-577p-hgj9BIT-magento-2021-21027CVE-2021-21027Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento incorrect permissions vulnerability in the Inventory moduleGHSA-p7m7-j8jv-393qBIT-magento-2020-24405CVE-2020-24405Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento observable timing discrepancy vulnerabilityGHSA-xgp9-j48h-jjf9BIT-magento-2020-9690CVE-2020-9690Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-6w27-c66f-gvhqCVE-2025-24430Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-7jmr-43qj-pw47CVE-2025-24432Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento information disclosure vulnerabilityGHSA-mr8q-7f5j-wc79BIT-magento-2020-24406CVE-2020-24406Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

LowMagento Improper Access Control vulnerabilityGHSA-656q-fx2w-8ccvCVE-2025-24429Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

LowMagento Authenticated Security feature bypassGHSA-85jx-x9r4-45m2CVE-2025-49549Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

LowMagento does not properly protect credentialsGHSA-2r94-wm5v-4prxCVE-2025-27192Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

LowMagento Open Source Information Exposure vulnerabilityGHSA-4f89-5cwm-rm5gBIT-magento-2024-45134CVE-2024-45134Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Improper Access Control vulnerabilityGHSA-8pxg-gcp4-57wwBIT-magento-2024-45135CVE-2024-45135Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Information Exposure vulnerabilityGHSA-j3mh-wx5f-2vhgBIT-magento-2024-45133CVE-2024-45133Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento Open Source Improper Access Control vulnerabilityGHSA-w7rg-7wq2-pjrwBIT-magento-2024-45149CVE-2024-45149Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

LowMagento incorrect user permissions vulnerability within the Inventory componentGHSA-39rw-4m66-82gfBIT-magento-2020-24403CVE-2020-24403Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

LowMagento 2 Community Edition vulnerable to Improper AuthorizationGHSA-rwf7-652f-76mvBIT-magento-2020-24404CVE-2020-24404Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

Does not affect 2.0.10

SEVERITYADVISORYPUBLISHED

CriticalMagento Open Source allows Stored Cross-Site Scripting (Stored XSS)GHSA-4vj2-426r-jm3gCVE-2022-35698Affected >=2.4.3-p1 <=2.4.3-p3, ==2.4.3, 2.4.4 - 2.4.4-p1, ==2.4.5OSV source ↗4 years ago

CriticalMagento Broken authentication and session managememtGHSA-8mwx-wpp4-5xh4CVE-2019-8149Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento 2 Community Edition SQLi VulnerabilityGHSA-4j6w-9rf8-hg7rCVE-2019-7139Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

CriticalMagento deserialization vulnerabilityGHSA-9wc9-498w-h8xvBIT-magento-2020-3716CVE-2020-3716Affected >=2.2.0 <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

CriticalMagento 2 Community Edition XML InjectionGHSA-8p5c-f836-m4h7CVE-2019-8158Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

CriticalMagento 2 Community Edition RCE VulnerabilityGHSA-vpg9-gq7j-mxqgCVE-2019-8144Affected >=2.3 <2.3.2-p1Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento 2 Community Edition Insecure ComponentGHSA-xgcp-59g2-wm8gCVE-2019-8136Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento improper input validation vulnerabilityGHSA-f8fv-f786-9933BIT-magento-2022-24086CVE-2022-24086Affected >=2.3.3-p1 <2.3.7-p3, >=2.4.0 <2.4.3-p2Fixed in 2.3.7-p3 Fixed in 2.4.3-p2OSV source ↗5 years ago

CriticalRemote code execution via vulnerable Symphony dependecy injectionGHSA-3q5x-7mxp-rp6jCVE-2019-8135Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗7 years ago

CriticalMagento RCE,XSS and other vulnerabilitiesGHSA-8j7c-682x-r9f2Affected >=2.1 <2.1.16, >=2.2 <2.2.7, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.16 Fixed in 2.2.7OSV source ↗2 years ago

CriticalMagento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilitiesGHSA-5gmh-85x8-5cx7Affected >=2.1 <2.1.14, >=2.2 <2.2.5, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.14 Fixed in 2.2.5OSV source ↗2 years ago

CriticalMagento Open Source Security Advisory: Patch SUPEE-10975GHSA-cv25-3pxr-4q7xAffected >=1.9.0.0 <1.14.4.0Fixed in 1.14.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-9652 - Remote Code Execution using mail vulnerabilityGHSA-26hq-7286-mg8fAffected >=1.9.0.0 <1.14.3.2Fixed in 1.14.3.2OSV source ↗2 years ago

CriticalMagento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilitiesGHSA-6wm4-3rjj-c8xxAffected >=1.5.0.0 <1.9.4.0Fixed in 1.9.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-10752 - Multiple security enhancements vulnerabilitiesGHSA-prpf-cj87-hwvrAffected <1.9.3.9Fixed in 1.9.3.9OSV source ↗2 years ago

CriticalMagento Open Source allows Cross-Site Scripting (XSS)GHSA-264g-f7v8-q5qqCVE-2024-20719Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento Open Source allows OS Command InjectionGHSA-525f-pvj5-vqmqCVE-2024-20720Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-mxc9-g6m4-2v35CVE-2023-38208Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-gfmm-ww6f-5mm5CVE-2023-29297Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Input ValidationGHSA-wh4m-6rh3-p4rqBIT-magento-2024-20758CVE-2024-20758Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento Open Source allows Incorrect AuthorizationGHSA-rpc7-gf58-v3x2CVE-2023-38218Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Improper Access Control vulnerabilityGHSA-x95x-f4g9-mm85BIT-magento-2022-34255CVE-2022-34255Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento remote code execution vulnerabilityGHSA-4v2q-hjx3-c4vrCVE-2019-8154Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-47h6-hfpv-7phjCVE-2019-8159Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-p783-gj6m-9r88CVE-2019-8150Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento SQL injection via marketing account with access to email templates variablesGHSA-45gj-78hc-4mvcCVE-2019-8134Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-jrjx-8gmw-jj2qCVE-2019-8137Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-5v5p-x8c2-mqxpCVE-2019-8122Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

HighMagento SQL injection vulnerabilityGHSA-x42g-82pp-4v6gCVE-2019-8130Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition SQLi VulnerabilityGHSA-2x2q-2xpv-mcf9CVE-2019-8127Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-2crc-5vq6-386rCVE-2019-8111Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento Information Disclosure via File upload functionalityGHSA-32x5-6p4q-q8jhCVE-2019-8093Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-gfcq-wh3g-c6h4CVE-2019-8110Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago