.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/project-community-edition 1.9.4.3 vulnerabilities

161 advisories known · magento/project-community-edition · This release has not been checked · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Some details missing

Not checked

SEVERITYADVISORYPUBLISHED

CriticalMagento Open Source allows Stored Cross-Site Scripting (Stored XSS)GHSA-4vj2-426r-jm3gCVE-2022-35698Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento business logic error vulnerabilityGHSA-5j4w-v87m-8r65BIT-magento-2020-9630CVE-2020-9630Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento security mitigation bypass vulnerabilityGHSA-6w29-x5j4-qhrwBIT-magento-2020-9632CVE-2020-9632Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento security mitigation bypass vulnerabilityGHSA-gffx-9f36-r8wpBIT-magento-2020-9631CVE-2020-9631Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento Defense-in-depth security mitigation vulnerabilityGHSA-55gv-hfg3-hwjqBIT-magento-2020-9585CVE-2020-9585Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-c3m4-hxv9-4mxjBIT-magento-2020-9582CVE-2020-9582Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-c55h-7q4j-g6rqBIT-magento-2020-9583CVE-2020-9583Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-4f7x-gjqc-qqpgBIT-magento-2020-9576CVE-2020-9576Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento command injection vulnerabilityGHSA-724x-gqhv-9c5xBIT-magento-2020-9578CVE-2020-9578Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento Security mitigation bypass vulnerabilityGHSA-j2jp-58gv-g2pgBIT-magento-2020-9580CVE-2020-9580Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento DOM-based Cross-site scripting vulnerabilityGHSA-g7pc-799q-743fBIT-magento-2020-9691CVE-2020-9691Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento has an XML Injection vulnerabilityGHSA-5pjj-7fq8-9gpfCVE-2021-36028Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento XML Injection vulnerability in the Widgets ModuleGHSA-p746-qw73-qmmxCVE-2021-36033Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento Community Edition Improper Input Validation vulnerabilityGHSA-wh92-6q6g-px7jCVE-2025-54236Affected <=2.0.2OSV source ↗last year

CriticalImproper Authorization vulnerability in Magento and Adobe CommerceGHSA-fppq-f2m6-xv5cCVE-2025-24434Affected <=2.0.2OSV source ↗2 years ago

CriticalMagento Open Source allows Cross-Site Scripting (XSS)GHSA-264g-f7v8-q5qqCVE-2024-20719Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento Open Source allows OS Command InjectionGHSA-525f-pvj5-vqmqCVE-2024-20720Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento affected by remote code execution vulnerability in the CMS page scheduled update featureGHSA-4g27-q2w9-m8m8BIT-magento-2021-36021CVE-2021-36021Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento XML Injection vulnerability in the Widgets Update LayoutGHSA-8cjg-f53m-8m9qBIT-magento-2021-36023CVE-2021-36023Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento improper access control vulnerability within Magento's Media Gallery Upload workflowGHSA-wqr6-wv6c-p8fxBIT-magento-2021-36036CVE-2021-36036Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-mxc9-g6m4-2v35CVE-2023-38208Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento Open Source allows Improper Neutralization of Special Elements UsedGHSA-gfmm-ww6f-5mm5CVE-2023-29297Affected <=2.0.2OSV source ↗3 years ago

CriticalMagento is affected by an improper input validation vulnerability while saving a customer's detailsGHSA-gvfx-9m9v-h839CVE-2021-36025Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento has a file extension restrictions bypassGHSA-2pq5-gpqf-g4r3CVE-2021-36040Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento executes code via the API File Option Upload ExtensionGHSA-6cwv-wj7v-73xpCVE-2021-36042Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento vulnerable to a file upload restriction bypassGHSA-269w-pqc7-68q9BIT-magento-2021-21014CVE-2021-21014Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento XPath InjectionGHSA-h437-qjj9-vmq4BIT-magento-2021-21025CVE-2021-21025Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento OS command injection via the WebAPIGHSA-792f-c8mp-2cr5BIT-magento-2021-21016CVE-2021-21016Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento 2 Community Edition RCE via Unsafe File UploadGHSA-7pxg-6p87-8c9vBIT-magento-2020-24407CVE-2020-24407Affected <=2.0.2OSV source ↗4 years ago

CriticalMagento Open Source allows Improper Input ValidationGHSA-wh4m-6rh3-p4rqBIT-magento-2024-20758CVE-2024-20758Affected <=2.0.2OSV source ↗3 years ago

HighMagento Open Source allows Incorrect AuthorizationGHSA-rpc7-gf58-v3x2CVE-2023-38218Affected <=2.0.2OSV source ↗3 years ago

HighMagento is affected by an improper input validation vulnerabilityGHSA-5vw8-r55w-f4q4CVE-2021-36032Affected <=2.0.2OSV source ↗4 years ago

HighMagento Cross-site Scripting vulnerabilityGHSA-8mq8-c243-2335CVE-2025-49557Affected <=2.0.2OSV source ↗last year

HighMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-8884-7rm9-mrx4CVE-2025-24438Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-fhw6-3mj5-w9gvCVE-2025-24414Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-g3j6-9753-8mp2CVE-2025-24417Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-gc27-rvvm-q77rCVE-2025-24415Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-gjxp-46rq-wg4qCVE-2025-24410Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-m4rg-mpp2-97pxCVE-2025-24412Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-rjjw-g6hw-7pc9CVE-2025-24416Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) VulnerabilityGHSA-xwgx-8v72-4j5jCVE-2025-24413Affected <=2.0.2OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-3j7w-jp46-9752CVE-2023-38219Affected <=2.0.2OSV source ↗3 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-2ff6-837j-hg5xCVE-2024-39402Affected <=2.0.2OSV source ↗2 years ago

HighMagento OS Command ('OS Command Injection') vulnerabilityGHSA-8frp-pxq2-3gpqCVE-2024-39401Affected <=2.0.2OSV source ↗2 years ago

HighMagento Improper Authorization leading to security feature bypassGHSA-r487-9vv5-75ggCVE-2025-43585Affected <=2.0.2OSV source ↗last year

HighAdobe Commerce Improper Authorization vulnerabilityGHSA-vw47-79jv-3598CVE-2025-24409Affected <=2.0.2OSV source ↗2 years ago

HighMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-2768-5wmv-cfffCVE-2025-54264Affected <=2.0.2OSV source ↗last year

HighMagento provides incorrect authorization through a security feature bypassGHSA-69x9-xp2j-w8g8CVE-2025-54263Affected <=2.0.2OSV source ↗last year

HighMagento Cross-Site Request Forgery (CSRF) vulnerabilityGHSA-5777-jj7p-mpqwCVE-2025-49555Affected <=2.0.2OSV source ↗last year

HighMagento Improper Access Control vulnerabilityGHSA-36hw-x3cc-m258CVE-2025-24411Affected <=2.0.2OSV source ↗2 years ago

HighMagento DOM-based Cross-Site Scripting (XSS) vulnerabilityGHSA-52fg-wjxm-pp44CVE-2024-39400Affected <=2.0.2OSV source ↗2 years ago

HighMagento Open Source allows Cross-Site Scripting (XSS)GHSA-59vf-hjxc-f9c5BIT-magento-2024-20759CVE-2024-20759Affected <=2.0.2OSV source ↗3 years ago

HighMagento stored cross-site scripting (XSS) in the customer address upload featureGHSA-6988-g89m-27vfBIT-magento-2021-21030CVE-2021-21030Affected <=2.0.2OSV source ↗4 years ago

HighMagento Open Source allows SQL Injection GHSA-h3g9-cwr6-hphxCVE-2023-38250Affected <=2.0.2OSV source ↗3 years ago

HighMagento Open Source allows SQL InjectionGHSA-rq36-9f5f-2gw7CVE-2023-38249Affected <=2.0.2OSV source ↗3 years ago

HighMagento Open Source allows SQL Injection GHSA-ggr8-3hwx-4f2mCVE-2023-38221Affected <=2.0.2OSV source ↗3 years ago

HighMagento XML Injection vulnerability in the 'City' fieldGHSA-xvpx-6hh8-7h72CVE-2021-36020Affected <=2.0.2OSV source ↗4 years ago

HighMagento Path Traversal vulnerability via the `theme[preview_image]` parameterGHSA-7w95-qwhh-q9p3CVE-2021-36031Affected <=2.0.2OSV source ↗4 years ago

HighMagento allows attackers to alter the price of itemsGHSA-rhff-65hp-55rwCVE-2021-36030Affected <=2.0.2OSV source ↗4 years ago

HighMagento affected by a blind SSRF vulnerability in the bundled dotmailer extensionGHSA-36xq-7w8w-xp68CVE-2021-36043Affected <=2.0.2OSV source ↗4 years ago

HighMagento Path Traversal vulnerabilityGHSA-7r99-8wqp-h7pcCVE-2024-39399Affected <=2.0.2OSV source ↗2 years ago

HighMagento Stored Cross-Site Scripting (XSS) vulnerability GHSA-mmp7-8cg4-9wrgCVE-2024-39403Affected <=2.0.2OSV source ↗2 years ago

HighMagento has incorrect authorization issue that leads to arbitrary file system readGHSA-7hrj-3c9x-xv5hCVE-2025-49556Affected <=2.0.2OSV source ↗last year

HighMagento vulnerable to denial of serviceGHSA-xgfm-992v-h2hrCVE-2025-49554Affected <=2.0.2OSV source ↗last year

HighAdobe Commerce Path TraversalGHSA-954p-ff72-327wCVE-2025-24406Affected <=2.0.2OSV source ↗2 years ago

HighMagento Open Source allows Improper AuthorizationGHSA-grc6-r6f8-xj7cCVE-2023-38220Affected <=2.0.2OSV source ↗3 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5jfg-phx7-7fxgCVE-2023-22248Affected <=2.0.2OSV source ↗3 years ago

HighMagento Open Source allows XML InjectionGHSA-2444-8gj8-6fmxCVE-2023-22247Affected <=2.0.2OSV source ↗4 years ago

HighMagento affected by a server-side denial-of-service using a GraphQL fieldGHSA-wr57-3h2f-3q95CVE-2021-36044Affected <=2.0.2OSV source ↗4 years ago

HighMagento Violation of Secure Design Principles vulnerability in RMA PDF filename formatsGHSA-7gh6-f4jh-3crqBIT-magento-2021-28583CVE-2021-28583Affected <=2.0.2OSV source ↗4 years ago

HighMagento authorization bypass vulnerabilityGHSA-8wm7-h2qh-ff4cBIT-magento-2020-9587CVE-2020-9587Affected <=2.0.2OSV source ↗4 years ago

HighUnauthenticated crypto and weak IV in Magento\Framework\EncryptionGHSA-h7qw-mxrm-c6h2CVE-2016-6485Affected >=2.0 <=2.0.2, 2.0.0-rc - 2.0.0-rc2OSV source ↗7 years ago

HighMagento does not properly restrict excessive authentication attemptsGHSA-q628-54wg-4r5qCVE-2024-39398Affected <=2.0.2OSV source ↗2 years ago

HighMagento Open Source affected by Improper Input ValidationGHSA-5xmp-7wg5-x68qCVE-2022-24093Affected <=2.0.2OSV source ↗3 years ago

HighMagento XML Injection vulnerability in the Widgets Update LayoutGHSA-3x9x-vhqj-cv27CVE-2021-36022Affected <=2.0.2OSV source ↗4 years ago

HighMagento improper authorization vulnerabilityGHSA-m8wx-whpp-q283CVE-2021-36029Affected <=2.0.2OSV source ↗4 years ago

HighMagento is affected by an os command injection via the Data collection endpointGHSA-qmq6-jpvg-j547CVE-2021-36024Affected <=2.0.2OSV source ↗4 years ago

HighMagento affected by remote code execution via a file uploadGHSA-j46h-qjjv-cxfjCVE-2021-36034Affected <=2.0.2OSV source ↗4 years ago

HighMagento vulnerable to file upload attackGHSA-mx5m-j5xr-jg8cCVE-2021-36041Affected <=2.0.2OSV source ↗4 years ago

HighMagento Signature verification bypassGHSA-j2r4-2cr6-h3r3BIT-magento-2020-9588CVE-2020-9588Affected <=2.0.2OSV source ↗4 years ago

HighMagento 2 Community Edition RCE VulnerabilityGHSA-crv7-r357-gw3wCVE-2019-8114Affected <1.9.4.3Fixed in 1.9.4.3OSV source ↗4 years ago

MediumMagento DOM-based Cross-Site Scripting vulnerability on mage-messages cookiesGHSA-39ch-rg26-gmq5BIT-magento-2021-28556CVE-2021-28556Affected <=2.0.2OSV source ↗4 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-8jxc-5f94-22vhCVE-2023-26366Affected <=2.0.2OSV source ↗3 years ago

MediumMagento vulnerable to privilege escalation due to incorrect authorizationGHSA-qvwr-p3hj-j6jfCVE-2025-54267Affected <=2.0.2OSV source ↗last year

MediumMagento Improper Access Control vulnerabilityGHSA-v3hq-g424-5mggCVE-2025-24427Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Information Exposure vulnerabilityGHSA-3cfg-w257-cgf8CVE-2025-24408Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-539v-w87w-w62cCVE-2025-24424Affected <=2.0.2OSV source ↗2 years ago

MediumMagento Open Source allows Incorrect Authorization GHSA-3vg2-v639-6ch9CVE-2023-38209Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-wh42-8r2w-873xCVE-2023-29289Affected <=2.0.2OSV source ↗3 years ago

MediumMagento Open Source allows Cross-Site Request Forgery (CSRF)GHSA-94wq-87g6-8h77CVE-2021-39864Affected <=2.0.2OSV source ↗4 years ago

MediumMagento affected by a business logic error in the placeOrder graphql mutationGHSA-3f97-7pgv-gmgrCVE-2021-36012Affected <=2.0.2OSV source ↗4 years ago

MediumMagento discloses sensitive informationGHSA-3g7m-g8qm-x6j5CVE-2021-36039Affected <=2.0.2OSV source ↗4 years ago

MediumMagento is affected by an improper authorization vulnerabilityGHSA-vrq2-w7r7-3fp2CVE-2021-36037Affected <=2.0.2OSV source ↗4 years ago

MediumMagento discloses sensitive information via the Multishipping ModuleGHSA-wgpr-9675-8r67CVE-2021-36038Affected <=2.0.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Incorrect AuthorizationGHSA-f2g3-3c6q-4478BIT-magento-2020-24401CVE-2020-24401Affected <=2.0.2OSV source ↗4 years ago

MediumMagento path traversal vulnerabilityGHSA-fr6f-xmfx-rrpqBIT-magento-2020-9689CVE-2020-9689Affected <=2.0.2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-2w2x-7qgj-4x78BIT-magento-2020-9581CVE-2020-9581Affected <=2.0.2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-689w-2f93-2x67BIT-magento-2020-9577CVE-2020-9577Affected <=2.0.2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-x2v2-2jhp-c5hvCVE-2021-36027Affected <=2.0.2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerability in the customer address upload featureGHSA-8gfq-m4cf-w975CVE-2021-36026Affected <=2.0.2OSV source ↗4 years ago