.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.4.6-p9 vulnerabilities

360 advisories known · magento/community-edition@2.4.6-p9 · 21 affect this release · Dependencies not checked · showing 100 more

SEVERITYADVISORYPUBLISHED

Does not affect 2.4.6-p9

SEVERITYADVISORYPUBLISHED

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-2ff6-837j-hg5xCVE-2024-39402Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-8frp-pxq2-3gpqCVE-2024-39401Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighAdobe Commerce Improper Authorization vulnerabilityGHSA-vw47-79jv-3598CVE-2025-24409Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source Improper Authorization vulnerabilityGHSA-wwj3-573j-rvvmBIT-magento-2024-34104CVE-2024-34104Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

HighMagento Improper Access Control vulnerabilityGHSA-36hw-x3cc-m258CVE-2025-24411Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source Cross-Site Scripting (XSS) vulnerabilityGHSA-873m-72g6-853gCVE-2024-45116Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

HighMagento DOM-based Cross-Site Scripting (XSS) vulnerabilityGHSA-52fg-wjxm-pp44CVE-2024-39400Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Open Source Improper Authentication vulnerabilityGHSA-f7q4-9gwv-6774BIT-magento-2024-34103CVE-2024-34103Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-59vf-hjxc-f9c5BIT-magento-2024-20759CVE-2024-20759Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento stored cross-site scripting (XSS) in the customer address upload featureGHSA-6988-g89m-27vfBIT-magento-2021-21030CVE-2021-21030Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

HighMagento Open Source allows SQL Injection GHSA-h3g9-cwr6-hphxCVE-2023-38250Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source allows SQL InjectionGHSA-rq36-9f5f-2gw7CVE-2023-38249Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source allows SQL Injection GHSA-ggr8-3hwx-4f2mCVE-2023-38221Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento XML Injection vulnerability in the 'City' fieldGHSA-xvpx-6hh8-7h72CVE-2021-36020Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento Path Traversal vulnerability via the `theme[preview_image]` parameterGHSA-7w95-qwhh-q9p3CVE-2021-36031Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento allows attackers to alter the price of itemsGHSA-rhff-65hp-55rwCVE-2021-36030Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento affected by a blind SSRF vulnerability in the bundled dotmailer extensionGHSA-36xq-7w8w-xp68CVE-2021-36043Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento OS command injection via the customer attribute save controllerGHSA-w2p4-2c8c-2g7hBIT-magento-2021-21015CVE-2021-21015Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE Vulnerability via CSRFGHSA-x72m-p4qc-p7rvCVE-2019-8109Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighUsing JS libraries with known security vulnerabilitiesGHSA-89ch-hqf9-rgp3CVE-2019-8121Affected >=2.2 <2.2.10, >=2.3 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗7 years ago

HighMagento Path Traversal vulnerabilityGHSA-7r99-8wqp-h7pcCVE-2024-39399Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Open Source Improper Input Validation vulnerabilityGHSA-3fr3-gcqh-3m2gCVE-2024-45117Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) vulnerability GHSA-mmp7-8cg4-9wrgCVE-2024-39403Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighAdobe Commerce Path TraversalGHSA-954p-ff72-327wCVE-2025-24406Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source allows Improper AuthorizationGHSA-grc6-r6f8-xj7cCVE-2023-38220Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5jfg-phx7-7fxgCVE-2023-22248Affected >=2.4.4-p1 <2.4.5-p4, ==2.4.4, ==2.4.6Fixed in 2.4.5-p3 Fixed in 2.4.5-p4OSV source ↗3 years ago

HighMagento Open Source allows XML InjectionGHSA-2444-8gj8-6fmxCVE-2023-22247Affected >=2.4.4-p1 <2.4.4-p3, >=2.4.5-p1 <2.4.5-p2, ==2.4.4, ==2.4.5Fixed in 2.4.4-p3 Fixed in 2.4.5-p2OSV source ↗4 years ago

HighMagento Improper Authorization vulnerabilityGHSA-r7mm-grf3-5fjvBIT-magento-2022-34256CVE-2022-34256Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento affected by a server-side denial-of-service using a GraphQL fieldGHSA-wr57-3h2f-3q95CVE-2021-36044Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento Violation of Secure Design Principles vulnerability in RMA PDF filename formatsGHSA-7gh6-f4jh-3crqBIT-magento-2021-28583CVE-2021-28583Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

HighMagento defense-in-depth security mitigation vulnerabilityGHSA-w7rh-9w5v-rwqjBIT-magento-2020-9591CVE-2020-9591Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

HighMagento authorization bypass vulnerabilityGHSA-8wm7-h2qh-ff4cBIT-magento-2020-9587CVE-2020-9587Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

HighMagento sql injection vulnerabilityGHSA-rr59-pjwj-6grjBIT-magento-2020-3719CVE-2020-3719Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

HighMagento 2 Community Edition Security BypassGHSA-p9vf-4jx2-5hppCVE-2019-8112Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition Access Control BypassGHSA-2fhr-f6q6-c4p2CVE-2019-7950Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Information LeakGHSA-5j25-5hjr-w7m2CVE-2019-7951Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition DoS vulnerabilityGHSA-hrg3-4q56-p2q5CVE-2019-7928Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition DoS vulnerabilityGHSA-prw8-gqwp-f7fhCVE-2019-7915Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Cryptographic FlawGHSA-c2gg-rrhc-fvvgCVE-2019-7886Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Cryptographic FlawGHSA-7h8v-f2g9-39fxCVE-2019-7858Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Weak PRNGGHSA-8v9h-m7pj-hx7cCVE-2019-7860Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition IDOR VulnerabilityGHSA-hpxv-vpfv-7jc9CVE-2019-7854Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Path Traversal VulnerabilityGHSA-hqhf-8jgc-h5hxCVE-2019-7859Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Unsafe File UploadGHSA-j837-vm6w-6qcvCVE-2019-7861Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Session Fixation CheckGHSA-v797-hfv8-v2xmCVE-2019-7849Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighUnauthenticated crypto and weak IV in Magento\Framework\EncryptionGHSA-h7qw-mxrm-c6h2CVE-2016-6485Affected >=2.0 <2.2.6, 2.0.0-rc - 2.0.0-rc2Fixed in 2.2.6OSV source ↗7 years ago

HighMagento does not properly restrict excessive authentication attemptsGHSA-q628-54wg-4r5qCVE-2024-39398Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento 2 Community Edition IDOR VulnerabilityGHSA-3pgc-7jf3-5x5gCVE-2019-7890Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5xmp-7wg5-x68qCVE-2022-24093Affected >=2.3.7-p1 <2.3.7-p3, >=2.4.3-p1 <2.4.3-p2, ==2.3.7, ==2.4.3Fixed in 2.3.7-p3 Fixed in 2.4.3-p2OSV source ↗3 years ago

HighMagento XML Injection vulnerability in the Widgets Update LayoutGHSA-3x9x-vhqj-cv27CVE-2021-36022Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento improper authorization vulnerabilityGHSA-m8wx-whpp-q283CVE-2021-36029Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento is affected by an os command injection via the Data collection endpointGHSA-qmq6-jpvg-j547CVE-2021-36024Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento affected by remote code execution via a file uploadGHSA-j46h-qjjv-cxfjCVE-2021-36034Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento vulnerable to file upload attackGHSA-mx5m-j5xr-jg8cCVE-2021-36041Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento Signature verification bypassGHSA-j2r4-2cr6-h3r3BIT-magento-2020-9588CVE-2020-9588Affected <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

HighMagento 2 Community Edition SSRF vulnerabilityGHSA-775w-gx3f-4j4fCVE-2019-8156Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento Server-Side Request Forgery (SSRF)GHSA-f73h-224c-62qrCVE-2019-8151Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-9wr9-fw9v-8fgrCVE-2019-8141Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-j63v-wcf9-c9hmCVE-2019-8119Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-crv7-r357-gw3wCVE-2019-8114Affected <1.9.4.3, >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 1.9.4.3 Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Unrestricted File UploadGHSA-3h69-4frw-g2jmCVE-2019-7930Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-969v-mwp3-4mr3CVE-2019-7932Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCEGHSA-vvf9-fxhv-4rgjCVE-2019-7942Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Server-Side Request Forgery vulnerabilityGHSA-33cj-w75f-49m2CVE-2019-7911Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Filter extension bypass via crafted store configuration keysGHSA-f8h9-7rpq-7qccCVE-2019-7912Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition SSRF vulnerabilityGHSA-hppc-rpfp-r8qwCVE-2019-7913Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition SSRF vulnerabilityGHSA-hvcp-jvx5-4pmpCVE-2019-7923Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-2x55-mg9r-24f7CVE-2019-7896Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-jhvh-mjfg-5m99CVE-2019-7903Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-mw5w-cf76-73m8CVE-2019-7895Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE Vulnerability via SSRFGHSA-w3r8-fxv5-58ppCVE-2019-7892Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento SQL Injection vulnerabilityGHSA-pf6w-3pfw-fxvwBIT-magento-2020-24400CVE-2020-24400Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento DOM-based Cross-Site Scripting vulnerability on mage-messages cookiesGHSA-39ch-rg26-gmq5BIT-magento-2021-28556CVE-2021-28556Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Open Source Path Traversal vulnerabilityGHSA-6pxh-2557-5cj5CVE-2024-39406Affected <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-p1 <2.4.7-p2, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-8jxc-5f94-22vhCVE-2023-26366Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento 2 Community Edition RCE VulnerabilityGHSA-6vc8-3xf2-qrxxCVE-2019-8232Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-v3hq-g424-5mggCVE-2025-24427Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Information Exposure vulnerabilityGHSA-3cfg-w257-cgf8CVE-2025-24408Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-539v-w87w-w62cCVE-2025-24424Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-5f64-ppmg-cvvmBIT-magento-2024-45132CVE-2024-45132Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-cg52-68fv-94qqCVE-2024-45118Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Server-Side Request Forgery (SSRF) vulnerabilityGHSA-jmqp-r3gg-6jh3BIT-magento-2024-34111CVE-2024-34111Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source allows Incorrect Authorization GHSA-3vg2-v639-6ch9CVE-2023-38209Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-wh42-8r2w-873xCVE-2023-29289Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Cross-Site Request Forgery (CSRF)GHSA-94wq-87g6-8h77CVE-2021-39864Affected <2.3.7-p2, >=2.4.2-p1 <=2.4.2-p2, ==2.4.2, ==2.4.3Fixed in 2.3.7-p2OSV source ↗4 years ago

MediumMagento affected by a business logic error in the placeOrder graphql mutationGHSA-3f97-7pgv-gmgrCVE-2021-36012Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento discloses sensitive informationGHSA-3g7m-g8qm-x6j5CVE-2021-36039Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento is affected by an improper authorization vulnerabilityGHSA-vrq2-w7r7-3fp2CVE-2021-36037Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento discloses sensitive information via the Multishipping ModuleGHSA-wgpr-9675-8r67CVE-2021-36038Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento Unauthorized access to restricted resourcesGHSA-q9xx-4689-gvv5BIT-magento-2021-28563CVE-2021-28563Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition Incorrect AuthorizationGHSA-f2g3-3c6q-4478BIT-magento-2020-24401CVE-2020-24401Affected <2.4.1Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento security mitigation bypass vulnerabilityGHSA-vqg7-8v6x-54rqBIT-magento-2020-9692CVE-2020-9692Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

MediumMagento path traversal vulnerabilityGHSA-fr6f-xmfx-rrpqBIT-magento-2020-9689CVE-2020-9689Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

MediumMagento Injection vulnerability via email templatesGHSA-94q8-gx29-6mqvCVE-2019-8143Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition Arbitrary File DeletionGHSA-2cg3-w597-rjfvCVE-2019-8107Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Broken authentication and session managememtGHSA-92ph-xm9v-cg3jCVE-2019-8108Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition Arbitrary File DeletionGHSA-653q-vqm6-gmjmCVE-2019-8090Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition CSRF vulnerabilityGHSA-w392-68rg-pgg4CVE-2019-7947Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient Access ControlsGHSA-5hcx-vg88-hgpmCVE-2019-7904Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Injection VulnerabilityGHSA-hxmp-jcqj-83hmCVE-2019-7889Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago