.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition 2.4.7-p7 vulnerabilities

360 advisories known · magento/community-edition@2.4.7-p7 · 6 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 2.4.7-p7

SEVERITYADVISORYPUBLISHED

CriticalMagento Community Edition Improper Input Validation vulnerabilityGHSA-wh92-6q6g-px7jCVE-2025-54236Affected <=2.4.5-p14, >=2.4.6-p1 <=2.4.6-p12, >=2.4.7-beta1 <=2.4.7-p7, >=2.4.8-beta1 <=2.4.8-p2, >=2.4.9-alpha1 <=2.4.9-alpha2, ==2.4.6, ==2.4.9OSV source ↗last year

HighMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-2768-5wmv-cfffCVE-2025-54264Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

HighMagento provides incorrect authorization through a security feature bypassGHSA-69x9-xp2j-w8g8CVE-2025-54263Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento vulnerable to privilege escalation due to incorrect authorizationGHSA-qvwr-p3hj-j6jfCVE-2025-54267Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento allows incorrect authorizationGHSA-r355-75hw-r8jfCVE-2025-54265Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-pcrx-r49h-x2w5CVE-2025-54266Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

Does not affect 2.4.7-p7

SEVERITYADVISORYPUBLISHED

CriticalMagento Open Source allows Stored Cross-Site Scripting (Stored XSS)GHSA-4vj2-426r-jm3gCVE-2022-35698Affected >=2.4.3-p1 <=2.4.3-p3, ==2.4.3, 2.4.4 - 2.4.4-p1, ==2.4.5OSV source ↗4 years ago

CriticalMagento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabilityGHSA-m8cj-3v68-3cxjBIT-magento-2024-34102CVE-2024-34102Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

CriticalMagento Broken authentication and session managememtGHSA-8mwx-wpp4-5xh4CVE-2019-8149Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento 2 Community Edition SQLi VulnerabilityGHSA-4j6w-9rf8-hg7rCVE-2019-7139Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

CriticalMagento business logic error vulnerabilityGHSA-5j4w-v87m-8r65BIT-magento-2020-9630CVE-2020-9630Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento security mitigation bypass vulnerabilityGHSA-6w29-x5j4-qhrwBIT-magento-2020-9632CVE-2020-9632Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento security mitigation bypass vulnerabilityGHSA-gffx-9f36-r8wpBIT-magento-2020-9631CVE-2020-9631Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento Defense-in-depth security mitigation vulnerabilityGHSA-55gv-hfg3-hwjqBIT-magento-2020-9585CVE-2020-9585Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-c3m4-hxv9-4mxjBIT-magento-2020-9582CVE-2020-9582Affected <2.2.12, >=2.3.0 <2.3.4-p2Fixed in 2.2.12 Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-c55h-7q4j-g6rqBIT-magento-2020-9583CVE-2020-9583Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-4f7x-gjqc-qqpgBIT-magento-2020-9576CVE-2020-9576Affected <2.2.12, >=2.3.0 <2.3.4-p2Fixed in 2.2.12 Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-724x-gqhv-9c5xBIT-magento-2020-9578CVE-2020-9578Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento Security mitigation bypass vulnerabilityGHSA-j2jp-58gv-g2pgBIT-magento-2020-9580CVE-2020-9580Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento Security mitigation bypass vulnerabilityGHSA-vrp3-wc28-qg2hBIT-magento-2020-9579CVE-2020-9579Affected <=2.2.11, >=2.3.0 <2.3.4-p2Fixed in 2.3.4-p2OSV source ↗4 years ago

CriticalMagento deserialization vulnerabilityGHSA-9wc9-498w-h8xvBIT-magento-2020-3716CVE-2020-3716Affected >=2.2.0 <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

CriticalMagento security bypass vulnerabilityGHSA-x9p7-vgp2-9pq2BIT-magento-2020-3718CVE-2020-3718Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

CriticalMagento 2 Community Edition XML InjectionGHSA-8p5c-f836-m4h7CVE-2019-8158Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

CriticalMagento 2 Community Edition RCE VulnerabilityGHSA-vpg9-gq7j-mxqgCVE-2019-8144Affected >=2.3 <2.3.2-p1Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento 2 Community Edition Insecure ComponentGHSA-xgcp-59g2-wm8gCVE-2019-8136Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

CriticalMagento improper input validation vulnerabilityGHSA-f8fv-f786-9933BIT-magento-2022-24086CVE-2022-24086Affected >=2.3.3-p1 <2.3.7-p3, >=2.4.0 <2.4.3-p2Fixed in 2.3.7-p3 Fixed in 2.4.3-p2OSV source ↗5 years ago

CriticalRemote code execution via vulnerable Symphony dependecy injectionGHSA-3q5x-7mxp-rp6jCVE-2019-8135Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗7 years ago

CriticalMagento DOM-based Cross-site scripting vulnerabilityGHSA-g7pc-799q-743fBIT-magento-2020-9691CVE-2020-9691Affected <2.3.5-p2Fixed in 2.3.5-p2OSV source ↗4 years ago

CriticalMagento RCE,XSS and other vulnerabilitiesGHSA-8j7c-682x-r9f2Affected >=2.1 <2.1.16, >=2.2 <2.2.7, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.16 Fixed in 2.2.7OSV source ↗2 years ago

CriticalMagento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilitiesGHSA-5gmh-85x8-5cx7Affected >=2.1 <2.1.14, >=2.2 <2.2.5, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.14 Fixed in 2.2.5OSV source ↗2 years ago

CriticalMagento Open Source Security Advisory: Patch SUPEE-10975GHSA-cv25-3pxr-4q7xAffected >=1.9.0.0 <1.14.4.0Fixed in 1.14.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-9652 - Remote Code Execution using mail vulnerabilityGHSA-26hq-7286-mg8fAffected >=1.9.0.0 <1.14.3.2Fixed in 1.14.3.2OSV source ↗2 years ago

CriticalMagento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilitiesGHSA-6wm4-3rjj-c8xxAffected >=1.5.0.0 <1.9.4.0Fixed in 1.9.4.0OSV source ↗2 years ago

CriticalMagento Patch SUPEE-10752 - Multiple security enhancements vulnerabilitiesGHSA-prpf-cj87-hwvrAffected <1.9.3.9Fixed in 1.9.3.9OSV source ↗2 years ago

CriticalMagento has an XML Injection vulnerabilityGHSA-5pjj-7fq8-9gpfCVE-2021-36028Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

CriticalMagento XML Injection vulnerability in the Widgets ModuleGHSA-p746-qw73-qmmxCVE-2021-36033Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

CriticalMagneto contains stored XSS vulnerabilityGHSA-j934-vjh5-vf9rCVE-2025-47110Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, >=2.4.8-beta1 <2.4.8-p1, ==2.4.6Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6 Fixed in 2.4.8-p1OSV source ↗last year

CriticalImproper Authorization vulnerability in Magento and Adobe CommerceGHSA-fppq-f2m6-xv5cCVE-2025-24434Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, >=2.4.8-beta1 <2.4.8-beta2Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4 Fixed in 2.4.8-beta2OSV source ↗2 years ago

CriticalMagento Open Source allows Cross-Site Scripting (XSS)GHSA-264g-f7v8-q5qqCVE-2024-20719Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento Open Source allows OS Command InjectionGHSA-525f-pvj5-vqmqCVE-2024-20720Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

CriticalMagento affected by remote code execution vulnerability in the CMS page scheduled update featureGHSA-4g27-q2w9-m8m8BIT-magento-2021-36021CVE-2021-36021Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗3 years ago

CriticalMagento XML Injection vulnerability in the Widgets Update LayoutGHSA-8cjg-f53m-8m9qBIT-magento-2021-36023CVE-2021-36023Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗3 years ago

CriticalMagento improper access control vulnerability within Magento's Media Gallery Upload workflowGHSA-wqr6-wv6c-p8fxBIT-magento-2021-36036CVE-2021-36036Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-mxc9-g6m4-2v35CVE-2023-38208Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-gfmm-ww6f-5mm5CVE-2023-29297Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

CriticalMagento XML Injection vulnerability in the Widgets ModuleGHSA-cj7w-pm77-hvg6BIT-magento-2022-34253CVE-2022-34253Affected <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

CriticalMagento is affected by an improper input validation vulnerability while saving a customer's detailsGHSA-gvfx-9m9v-h839CVE-2021-36025Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

CriticalMagento has a file extension restrictions bypassGHSA-2pq5-gpqf-g4r3CVE-2021-36040Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

CriticalMagento executes code via the API File Option Upload ExtensionGHSA-6cwv-wj7v-73xpCVE-2021-36042Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

CriticalMagento XML injection in the Widgets moduleGHSA-mw95-gmw4-883pBIT-magento-2021-21019CVE-2021-21019Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

CriticalMagento Blind SQL Injection in the Search moduleGHSA-rj4f-cp4v-hvcvBIT-magento-2021-21024CVE-2021-21024Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

CriticalMagento vulnerable to a file upload restriction bypassGHSA-269w-pqc7-68q9BIT-magento-2021-21014CVE-2021-21014Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

CriticalMagento XPath InjectionGHSA-h437-qjj9-vmq4BIT-magento-2021-21025CVE-2021-21025Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

CriticalMagento OS Command InjectionGHSA-rv48-v862-mp92BIT-magento-2021-21018CVE-2021-21018Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

CriticalMagento OS command injection via the WebAPIGHSA-792f-c8mp-2cr5BIT-magento-2021-21016CVE-2021-21016Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

CriticalMagento 2 Community Edition RCE via Unsafe File UploadGHSA-7pxg-6p87-8c9vBIT-magento-2020-24407CVE-2020-24407Affected <2.4.1Fixed in 2.4.1OSV source ↗4 years ago

CriticalMagento Open Source allows Improper Input ValidationGHSA-wh4m-6rh3-p4rqBIT-magento-2024-20758CVE-2024-20758Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento Open Source allows Incorrect AuthorizationGHSA-rpc7-gf58-v3x2CVE-2023-38218Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Improper input validation vulnerabilityGHSA-297f-r9w7-w492BIT-magento-2022-42344CVE-2022-42344Affected <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento Improper Access Control vulnerabilityGHSA-x95x-f4g9-mm85BIT-magento-2022-34255CVE-2022-34255Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento remote code execution vulnerabilityGHSA-4v2q-hjx3-c4vrCVE-2019-8154Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento is affected by an improper input validation vulnerabilityGHSA-5vw8-r55w-f4q4CVE-2021-36032Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-47h6-hfpv-7phjCVE-2019-8159Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-p783-gj6m-9r88CVE-2019-8150Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento SQL injection via marketing account with access to email templates variablesGHSA-45gj-78hc-4mvcCVE-2019-8134Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-jrjx-8gmw-jj2qCVE-2019-8137Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-5v5p-x8c2-mqxpCVE-2019-8122Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

HighMagento SQL injection vulnerabilityGHSA-x42g-82pp-4v6gCVE-2019-8130Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition SQLi VulnerabilityGHSA-2x2q-2xpv-mcf9CVE-2019-8127Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-2crc-5vq6-386rCVE-2019-8111Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento Information Disclosure via File upload functionalityGHSA-32x5-6p4q-q8jhCVE-2019-8093Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-gfcq-wh3g-c6h4CVE-2019-8110Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-mp9r-rh95-f8f8CVE-2019-7885Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-6qh6-v99h-vh4cCVE-2019-7876Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition Unsafe File UploadGHSA-v527-6h5r-cfg8CVE-2019-7871Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento 2 Community Edition CSRF VulnerabilityGHSA-wmrg-w9vg-7jqxCVE-2019-7865Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

HighMagento Cross-site Scripting vulnerabilityGHSA-8mq8-c243-2335CVE-2025-49557Affected <2.4.4-p15, >=2.4.5-p1 <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-p1 <2.4.7-p7, ==2.4.8Fixed in 2.4.4-p15 Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7OSV source ↗last year

HighMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-8884-7rm9-mrx4CVE-2025-24438Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-fhw6-3mj5-w9gvCVE-2025-24414Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-g3j6-9753-8mp2CVE-2025-24417Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-gc27-rvvm-q77rCVE-2025-24415Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-gjxp-46rq-wg4qCVE-2025-24410Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-m4rg-mpp2-97pxCVE-2025-24412Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-rjjw-g6hw-7pc9CVE-2025-24416Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-xwgx-8v72-4j5jCVE-2025-24413Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-3j7w-jp46-9752CVE-2023-38219Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

HighMagento Path Traversal vulnerabilityGHSA-fx9g-g9q6-x3jxBIT-magento-2022-34254CVE-2022-34254Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-2ff6-837j-hg5xCVE-2024-39402Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-8frp-pxq2-3gpqCVE-2024-39401Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Improper Authorization leading to security feature bypassGHSA-r487-9vv5-75ggCVE-2025-43585Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

HighAdobe Commerce Improper Authorization vulnerabilityGHSA-vw47-79jv-3598CVE-2025-24409Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source Improper Authorization vulnerabilityGHSA-wwj3-573j-rvvmBIT-magento-2024-34104CVE-2024-34104Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

HighMagento Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-5777-jj7p-mpqwCVE-2025-49555Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

HighMagento Improper Access Control vulnerabilityGHSA-36hw-x3cc-m258CVE-2025-24411Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

HighMagento Open Source Cross-Site Scripting (XSS) vulnerabilityGHSA-873m-72g6-853gCVE-2024-45116Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

HighMagento DOM-based Cross-Site Scripting (XSS) vulnerabilityGHSA-52fg-wjxm-pp44CVE-2024-39400Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

HighMagento Open Source Improper Authentication vulnerabilityGHSA-f7q4-9gwv-6774BIT-magento-2024-34103CVE-2024-34103Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-59vf-hjxc-f9c5BIT-magento-2024-20759CVE-2024-20759Affected >=2.4.4-p1 <2.4.4-p8, >=2.4.5-p1 <2.4.5-p7, >=2.4.6-p1 <2.4.6-p5, >=2.4.7-beta1 <2.4.7, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p8 Fixed in 2.4.5-p7 Fixed in 2.4.6-p5 Fixed in 2.4.7OSV source ↗3 years ago

HighMagento stored cross-site scripting (XSS) in the customer address upload featureGHSA-6988-g89m-27vfBIT-magento-2021-21030CVE-2021-21030Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

HighMagento Open Source allows SQL Injection GHSA-h3g9-cwr6-hphxCVE-2023-38250Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago