.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.2.9 vulnerabilities

360 advisories known · magento/community-edition@2.2.9 · 221 affect this release · Dependencies not checked · showing 100 more

SEVERITYADVISORYPUBLISHED

Affects 2.2.9

SEVERITYADVISORYPUBLISHED

MediumMagento 2 Community Edition RCE VulnerabilityGHSA-6vc8-3xf2-qrxxCVE-2019-8232Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento vulnerable to privilege escalation due to incorrect authorizationGHSA-qvwr-p3hj-j6jfCVE-2025-54267Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Improper Access Control vulnerabilityGHSA-v3hq-g424-5mggCVE-2025-24427Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Information Exposure vulnerabilityGHSA-3cfg-w257-cgf8CVE-2025-24408Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-539v-w87w-w62cCVE-2025-24424Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-5f64-ppmg-cvvmBIT-magento-2024-45132CVE-2024-45132Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-cg52-68fv-94qqCVE-2024-45118Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Server-Side Request Forgery (SSRF) vulnerabilityGHSA-jmqp-r3gg-6jh3BIT-magento-2024-34111CVE-2024-34111Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source allows Cross-Site Request Forgery (CSRF)GHSA-94wq-87g6-8h77CVE-2021-39864Affected <2.3.7-p2, >=2.4.2-p1 <=2.4.2-p2, ==2.4.2, ==2.4.3Fixed in 2.3.7-p2OSV source ↗4 years ago

MediumMagento affected by a business logic error in the placeOrder graphql mutationGHSA-3f97-7pgv-gmgrCVE-2021-36012Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento discloses sensitive informationGHSA-3g7m-g8qm-x6j5CVE-2021-36039Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento is affected by an improper authorization vulnerabilityGHSA-vrq2-w7r7-3fp2CVE-2021-36037Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento discloses sensitive information via the Multishipping ModuleGHSA-wgpr-9675-8r67CVE-2021-36038Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento Unauthorized access to restricted resourcesGHSA-q9xx-4689-gvv5BIT-magento-2021-28563CVE-2021-28563Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition Incorrect AuthorizationGHSA-f2g3-3c6q-4478BIT-magento-2020-24401CVE-2020-24401Affected <2.4.1Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento security mitigation bypass vulnerabilityGHSA-vqg7-8v6x-54rqBIT-magento-2020-9692CVE-2020-9692Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

MediumMagento path traversal vulnerabilityGHSA-fr6f-xmfx-rrpqBIT-magento-2020-9689CVE-2020-9689Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

MediumMagento Injection vulnerability via email templatesGHSA-94q8-gx29-6mqvCVE-2019-8143Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition Arbitrary File DeletionGHSA-2cg3-w597-rjfvCVE-2019-8107Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Broken authentication and session managememtGHSA-92ph-xm9v-cg3jCVE-2019-8108Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition Arbitrary File DeletionGHSA-653q-vqm6-gmjmCVE-2019-8090Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumBypass of sitemp access restrictionsGHSA-62fx-3v4f-mwxmCVE-2019-8133Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗7 years ago

MediumMagento Open Source reflected Cross-Site Scripting (XSS) vulnerabilityGHSA-88x2-cq34-5fwcCVE-2024-45123Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-jxjc-6xmh-h7mgBIT-magento-2020-24408CVE-2020-24408Affected <2.4.1Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-2w2x-7qgj-4x78BIT-magento-2020-9581CVE-2020-9581Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-689w-2f93-2x67BIT-magento-2020-9577CVE-2020-9577Affected <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-mgg3-v948-2vgrBIT-magento-2020-3715CVE-2020-3715Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-p5q3-xg47-653mBIT-magento-2020-3758CVE-2020-3758Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento Cross-site Scripting (XSS)GHSA-273r-v888-vgc6CVE-2019-8153Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumComposer JavaScript injection possible via html commentsGHSA-fm68-89m8-4gjjCVE-2019-8233Affected >=2.2 <2.2.10, >=2.3 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗7 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-x2v2-2jhp-c5hvCVE-2021-36027Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerability in the customer address upload featureGHSA-8gfq-m4cf-w975CVE-2021-36026Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento allows incorrect authorizationGHSA-r355-75hw-r8jfCVE-2025-54265Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-wcmw-8xpp-rwfjCVE-2025-49558Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Insufficient Session ExpirationGHSA-4h3p-63x6-vwg2BIT-magento-2021-21031CVE-2021-21031Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Insufficient Session ExpirationGHSA-4jfq-f8hc-775qBIT-magento-2021-21032CVE-2021-21032Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-469f-wf4f-3jjvCVE-2025-24437Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-mm87-rrqx-94crCVE-2025-24428Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-xc5p-773w-m3pmBIT-magento-2024-45131CVE-2024-45131Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-qpp7-742q-58j3BIT-magento-2024-45128CVE-2024-45128Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Path Traversal vulnerabilityGHSA-7gpv-xrjr-f5h4BIT-magento-2021-28584CVE-2021-28584Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Stored cross-site scriptingGHSA-45h4-6gcj-6hwvBIT-magento-2020-9584CVE-2020-9584Affected <2.2.12, >=2.3.0 <2.3.4-p2Fixed in 2.2.12 Fixed in 2.3.4-p2OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via admin panelGHSA-vrw4-34p5-pjg5CVE-2019-8157Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-6m27-3r8q-c7f7CVE-2019-8146Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v8fg-p27h-mxjpCVE-2019-8147Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-298q-wv2h-v5vwCVE-2019-8142Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-85xw-3hp5-6fmcCVE-2019-8138Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-gjjm-4x3g-3h33CVE-2019-8139Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-g378-6fg4-gx3vCVE-2019-8132Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via store nameGHSA-mhwc-4w67-xq2cCVE-2019-8128Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-vx7m-v8v2-fhwmCVE-2019-8131Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via Signifyd Guarantee Option Translation OverrideGHSA-wg25-j79r-v5wpCVE-2019-8129Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-985w-mqqp-7287CVE-2019-8120Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v99w-jxr4-w6mcCVE-2019-8117Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-56hf-w8gm-448qCVE-2019-8092Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via Attribute Set NameGHSA-xv69-f7x5-r4qwCVE-2019-8145Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗7 years ago

MediumMagento vulnerable to path traversalGHSA-h4f4-gv6h-x824CVE-2025-49559Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Improper Access Control leads to security feature bypassGHSA-g2pj-xmxq-3r9qCVE-2025-27206Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

MediumMagento Improper Access Control leads to Security feature bypassGHSA-6wq7-cg9h-mj6qCVE-2025-27190Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Improper Access Control leads to Security feature bypassGHSA-vhcq-4xrm-2cr2CVE-2025-27191Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Business Logic Error vulnerabilityGHSA-6ff8-jrfg-43hhCVE-2025-24425Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-w3p2-pc3h-69wvBIT-magento-2024-45124CVE-2024-45124Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Incorrect Authorization vulnerabilityGHSA-p6h9-gx5g-wg64BIT-magento-2024-34106CVE-2024-34106Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-r7cm-g469-wm4gBIT-magento-2024-34107CVE-2024-34107Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Improper input validation vulnerabilityGHSA-c38m-9668-6j2wBIT-magento-2021-28585CVE-2021-28585Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Insecure Direct Object Reference (IDOR) in the product moduleGHSA-8pfq-g48p-x7w8BIT-magento-2021-21022CVE-2021-21022Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento improper authorization vulnerability in the integrations moduleGHSA-crjc-2v9m-8w7rBIT-magento-2021-21026CVE-2021-21026Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento Improper Access ControlGHSA-2j6v-829g-885qBIT-magento-2021-21020CVE-2021-21020Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Path TraversalGHSA-874g-pxqp-frqpBIT-magento-2020-3717CVE-2020-3717Affected >=2.2.0 <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient LoggingGHSA-fp5m-4mqh-849pCVE-2019-8123Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition Weak CryptographyGHSA-hmch-9947-82rjCVE-2019-8118Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Weak PRNGGHSA-c4r2-3f9r-rwp8CVE-2019-8113Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerability in the customers moduleGHSA-cc3w-r3w8-hfh7BIT-magento-2021-28567CVE-2021-28567Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Open Source Server-Side Request Forgery (SSRF) vulnerabilityGHSA-g9fm-wc6h-pvgjCVE-2024-45119Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento incorrect permissions vulnerability in the Integrations componentGHSA-hvf5-4jr9-fghhBIT-magento-2020-24402CVE-2020-24402Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento Unrestricted file upload vulnerabilityGHSA-7pr3-34rg-g53mCVE-2019-8140Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient LoggingGHSA-x5q5-6wvf-2fpqCVE-2019-8124Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumInformation disclosure through processing of external XML entitiesGHSA-427g-2r83-3ccmCVE-2019-8126Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗7 years ago

MediumMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-pcrx-r49h-x2w5CVE-2025-54266Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Open Source stored Cross-Site Scripting (XSS) vulnerabilityGHSA-c89g-gq5r-2xw2BIT-magento-2024-45127CVE-2024-45127Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Scripting (XSS) vulnerabilityGHSA-5632-wq7m-gfq9BIT-magento-2024-34105CVE-2024-34105Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento stored cross-site scripting vulnerability in the admin consoleGHSA-h5rm-m772-6qcxBIT-magento-2021-21023CVE-2021-21023Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Reflected Cross-site Scripting vulnerability via 'file' parameterGHSA-jwxh-wj79-ccm6BIT-magento-2021-21029CVE-2021-21029Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-jjmg-xmq2-g6ffCVE-2019-8152Affected >=2.2.0 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-29mr-gr4c-vf9cCVE-2019-8115Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Security feature bypassGHSA-8hcx-xvww-6c6hCVE-2025-49550Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

MediumMagento Improper Authorization vulnerabilityGHSA-rr2g-rrjj-xw86CVE-2025-27188Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-p1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-82p4-55gj-956pCVE-2025-24435Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-ghpr-6qhr-rpp8CVE-2025-24436Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Incorrect Authorization vulnerabilityGHSA-v6r2-425c-hfrrCVE-2025-24421Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-2qhq-fw98-h6wgCVE-2024-45121Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-46fm-x82m-5f74CVE-2024-45122Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-47jp-46c9-25vfCVE-2024-45120Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-m58h-998x-66f3BIT-magento-2024-45129CVE-2024-45129Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-v3v6-jfvw-m576BIT-magento-2024-45130CVE-2024-45130Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Incorrect Authorization vulnerabilityGHSA-xg36-8c2v-jpxhBIT-magento-2024-45125CVE-2024-45125Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-4323-f82v-f6jrCVE-2024-39410Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Request Forgery vulnerabilityGHSA-4cj6-f32v-6hgxCVE-2024-39408Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xgg-rw35-7mv5CVE-2024-39416Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Improper Authorization leads to Security feature bypassGHSA-4xmj-f664-hv98CVE-2024-39417Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago