.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

magento/community-edition vulnerabilities

360 known advisories · Dependencies not checked · showing 100 more

SEVERITYADVISORYPUBLISHED

MediumMagento stored cross-site scripting vulnerabilityGHSA-mgg3-v948-2vgrBIT-magento-2020-3715CVE-2020-3715Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-p5q3-xg47-653mBIT-magento-2020-3758CVE-2020-3758Affected <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento Cross-site Scripting (XSS)GHSA-273r-v888-vgc6CVE-2019-8153Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento Reflected cross-site scripting on customer cart pageGHSA-r728-jwf5-f5r5CVE-2019-7939Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v5m6-2m78-4vr2CVE-2019-7877Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumComposer JavaScript injection possible via html commentsGHSA-fm68-89m8-4gjjCVE-2019-8233Affected >=2.2 <2.2.10, >=2.3 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗7 years ago

MediumMagento Cross-Site Scripting (XSS) vulnerabilityGHSA-mcfc-67vm-j568Affected >=2.1 <2.1.15, >=2.2 <2.2.6, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.15 Fixed in 2.2.6OSV source ↗2 years ago

MediumMagento stored cross-site scripting vulnerabilityGHSA-x2v2-2jhp-c5hvCVE-2021-36027Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento stored cross-site scripting vulnerability in the customer address upload featureGHSA-8gfq-m4cf-w975CVE-2021-36026Affected <2.3.7-p1, >=2.4.2-p1 <2.4.2-p2, ==2.4.2Fixed in 2.3.7-p1 Fixed in 2.4.2-p2OSV source ↗4 years ago

MediumMagento allows incorrect authorizationGHSA-r355-75hw-r8jfCVE-2025-54265Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilityGHSA-wcmw-8xpp-rwfjCVE-2025-49558Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Insufficient Session ExpirationGHSA-4h3p-63x6-vwg2BIT-magento-2021-21031CVE-2021-21031Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Insufficient Session ExpirationGHSA-4jfq-f8hc-775qBIT-magento-2021-21032CVE-2021-21032Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-5m55-g8pv-x8wwBIT-magento-2022-34258CVE-2022-34258Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-469f-wf4f-3jjvCVE-2025-24437Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento stored Cross-Site Scripting (XSS) vulnerabilityGHSA-mm87-rrqx-94crCVE-2025-24428Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-xc5p-773w-m3pmBIT-magento-2024-45131CVE-2024-45131Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Improper Authorization vulnerabilityGHSA-qpp7-742q-58j3BIT-magento-2024-45128CVE-2024-45128Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Improper Authorization vulnerabilityGHSA-gvgf-pvh5-vjh4CVE-2024-39418Affected >=2.4.4-p1 <2.4.4-p10, >=2.4.5-p1 <2.4.5-p9, >=2.4.6-p1 <2.4.6-p7, >=2.4.7-beta1 <2.4.7-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p10 Fixed in 2.4.5-p9 Fixed in 2.4.6-p7 Fixed in 2.4.7-p2OSV source ↗2 years ago

MediumMagento Path Traversal vulnerabilityGHSA-7gpv-xrjr-f5h4BIT-magento-2021-28584CVE-2021-28584Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Stored cross-site scriptingGHSA-45h4-6gcj-6hwvBIT-magento-2020-9584CVE-2020-9584Affected <2.2.12, >=2.3.0 <2.3.4-p2Fixed in 2.2.12 Fixed in 2.3.4-p2OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via admin panelGHSA-vrw4-34p5-pjg5CVE-2019-8157Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-6m27-3r8q-c7f7CVE-2019-8146Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v8fg-p27h-mxjpCVE-2019-8147Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-298q-wv2h-v5vwCVE-2019-8142Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-85xw-3hp5-6fmcCVE-2019-8138Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-gjjm-4x3g-3h33CVE-2019-8139Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-g378-6fg4-gx3vCVE-2019-8132Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via store nameGHSA-mhwc-4w67-xq2cCVE-2019-8128Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-vx7m-v8v2-fhwmCVE-2019-8131Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via Signifyd Guarantee Option Translation OverrideGHSA-wg25-j79r-v5wpCVE-2019-8129Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-985w-mqqp-7287CVE-2019-8120Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-v99w-jxr4-w6mcCVE-2019-8117Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-56hf-w8gm-448qCVE-2019-8092Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-3mxq-v9rw-m6x9CVE-2019-7944Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-c45w-p293-7cv6CVE-2019-7945Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-gg96-8w9x-7rx9CVE-2019-7921Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-ff7r-7rrm-wx6wCVE-2019-7882Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-7xqv-jgv6-x2h8CVE-2019-7881Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-Site Scripting via Attribute Set NameGHSA-xv69-f7x5-r4qwCVE-2019-8145Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗7 years ago

MediumMagento vulnerable to path traversalGHSA-h4f4-gv6h-x824CVE-2025-49559Affected <2.4.5-p14, >=2.4.6-p1 <2.4.6-p12, >=2.4.7-beta1 <2.4.7-p7, >=2.4.8-beta1 <2.4.8-p2, >=2.4.9-alpha1 <2.4.9-alpha2, ==2.4.6Fixed in 2.4.5-p14 Fixed in 2.4.6-p12 Fixed in 2.4.7-p7 Fixed in 2.4.8-p2 Fixed in 2.4.9-alpha2OSV source ↗last year

MediumMagento Improper Access Control leads to security feature bypassGHSA-g2pj-xmxq-3r9qCVE-2025-27206Affected <2.4.5-p13, >=2.4.6-p1 <2.4.6-p11, >=2.4.7-beta1 <2.4.7-p6, ==2.4.6, ==2.4.8Fixed in 2.4.5-p13 Fixed in 2.4.6-p11 Fixed in 2.4.7-p6OSV source ↗last year

MediumMagento Improper Access Control leads to Security feature bypassGHSA-6wq7-cg9h-mj6qCVE-2025-27190Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Improper Access Control leads to Security feature bypassGHSA-vhcq-4xrm-2cr2CVE-2025-27191Affected <2.4.4-p13, >=2.4.5-p1 <2.4.5-p12, >=2.4.6-p1 <2.4.6-p10, >=2.4.7-beta1 <2.4.7-p5, >=2.4.8-beta1 <2.4.8-beta2, ==2.4.5, ==2.4.6Fixed in 2.4.4-p13 Fixed in 2.4.5-p12 Fixed in 2.4.6-p10 Fixed in 2.4.7-p5 Fixed in 2.4.8-beta2OSV source ↗2 years ago

MediumMagento Business Logic Error vulnerabilityGHSA-6ff8-jrfg-43hhCVE-2025-24425Affected <2.4.4-p12, >=2.4.5-p1 <2.4.5-p11, >=2.4.6-p1 <2.4.6-p9, >=2.4.7-beta1 <2.4.7-p4, ==2.4.5, ==2.4.6, ==2.4.8-beta1Fixed in 2.4.4-p12 Fixed in 2.4.5-p11 Fixed in 2.4.6-p9 Fixed in 2.4.7-p4OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-w3p2-pc3h-69wvBIT-magento-2024-45124CVE-2024-45124Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Incorrect Authorization vulnerabilityGHSA-p6h9-gx5g-wg64BIT-magento-2024-34106CVE-2024-34106Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source Improper Access Control vulnerabilityGHSA-r7cm-g469-wm4gBIT-magento-2024-34107CVE-2024-34107Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-7pfc-834q-h497CVE-2023-38251Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento Open Source allows XML InjectionGHSA-rpv2-g4pc-wp72CVE-2023-38207Affected >=2.4.4-p1 <2.4.4-p5, >=2.4.5-p1 <2.4.5-p4, >=2.4.6-p1 <2.4.6-p2, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p5 Fixed in 2.4.5-p4 Fixed in 2.4.6-p2OSV source ↗3 years ago

MediumMagento Open Source allows Information ExposureGHSA-85m4-g9vq-xpxjCVE-2023-29287Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Incorrect AuthorizationGHSA-qw5m-vmp3-f553CVE-2023-29290Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-4h7p-4vq8-g2ghCVE-2023-22250Affected >=2.4.4-p1 <2.4.4-p3, >=2.4.5-p1 <2.4.5-p2, ==2.4.4, ==2.4.5Fixed in 2.4.4-p3 Fixed in 2.4.5-p2OSV source ↗4 years ago

MediumMagento Open Source allows Improper Access ControlGHSA-5fxx-jwjm-x9hjCVE-2022-35689Affected >=2.4.3-p1 <=2.4.3-p3, >=2.4.4-p1 <2.4.4-p2, ==2.4.3, ==2.4.4, ==2.4.5Fixed in 2.4.4-p2OSV source ↗4 years ago

MediumMagento Open Source has Improper Access Control vulnerabilityGHSA-gm4m-9rm8-7rxjCVE-2022-35692Affected >=2.3.7-p1 <2.3.7-p4, >=2.4.3-p1 <2.4.3-p3, ==2.3.7, ==2.4.3, ==2.4.4Fixed in 2.3.7-p4 Fixed in 2.4.3-p3OSV source ↗4 years ago

MediumMagento Improper Access Control vulnerabilityGHSA-9wjf-94h3-r4rhBIT-magento-2022-34259CVE-2022-34259Affected >=2.3.0 <2.3.7-p4, >=2.4.0 <2.4.3-p3, >=2.4.4 <2.4.5Fixed in 2.3.7-p4 Fixed in 2.4.3-p3 Fixed in 2.4.5OSV source ↗4 years ago

MediumMagento Improper input validation vulnerabilityGHSA-c38m-9668-6j2wBIT-magento-2021-28585CVE-2021-28585Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Insecure Direct Object Reference (IDOR) in the product moduleGHSA-8pfq-g48p-x7w8BIT-magento-2021-21022CVE-2021-21022Affected <2.3.6-p1, >=2.4.0 <2.4.1-p1Fixed in 2.3.6-p1 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento improper authorization vulnerability in the integrations moduleGHSA-crjc-2v9m-8w7rBIT-magento-2021-21026CVE-2021-21026Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento Improper Access ControlGHSA-2j6v-829g-885qBIT-magento-2021-21020CVE-2021-21020Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Path TraversalGHSA-874g-pxqp-frqpBIT-magento-2020-3717CVE-2020-3717Affected >=2.2.0 <2.2.11, >=2.3.0 <2.3.4Fixed in 2.2.11 Fixed in 2.3.4OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient LoggingGHSA-fp5m-4mqh-849pCVE-2019-8123Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition Weak CryptographyGHSA-hmch-9947-82rjCVE-2019-8118Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Weak PRNGGHSA-c4r2-3f9r-rwp8CVE-2019-8113Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-274w-2j5w-m2xjCVE-2019-7899Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-vqxq-3wqv-r9xpCVE-2019-7898Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition IDOR VulnerabilityGHSA-c33v-23rx-7qqcCVE-2019-7864Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Cryptographic FlawGHSA-2w26-gmqm-mc5pCVE-2019-7855Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Path DisclosureGHSA-xcgp-c6hp-cj4rCVE-2019-7852Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Improper Authorization vulnerability in the customers moduleGHSA-cc3w-r3w8-hfh7BIT-magento-2021-28567CVE-2021-28567Affected <2.3.7, >=2.4.0 <2.4.2-p1Fixed in 2.3.7 Fixed in 2.4.2-p1OSV source ↗4 years ago

MediumMagento Open Source Server-Side Request Forgery (SSRF) vulnerabilityGHSA-g9fm-wc6h-pvgjCVE-2024-45119Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source allows Uncontrolled Resource ConsumptionGHSA-c9h9-h5gf-885rCVE-2024-20716Affected >=2.4.4-p1 <2.4.4-p7, >=2.4.5-p1 <2.4.5-p6, >=2.4.6-p1 <2.4.6-p4, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p7 Fixed in 2.4.5-p6 Fixed in 2.4.6-p4OSV source ↗3 years ago

MediumMagento Open Source has Improper Input Validation VulnerabilityGHSA-9mx6-4gg4-85xjCVE-2023-26367Affected >=2.4.4-p1 <2.4.4-p6, >=2.4.5-p1 <2.4.5-p5, >=2.4.6-p1 <2.4.6-p3, >=2.4.7-beta1 <2.4.7-beta2, ==2.4.4, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p6 Fixed in 2.4.5-p5 Fixed in 2.4.6-p3 Fixed in 2.4.7-beta2OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-4588-7x48-jrgjCVE-2023-29292Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento Open Source allows Server-Side Request Forgery (SSRF)GHSA-5f79-vhr4-vw2rCVE-2023-29291Affected >=2.4.4-p1 <2.4.4-p4, >=2.4.5-p1 <2.4.5-p3, ==2.4.4, ==2.4.5, ==2.4.6Fixed in 2.4.4-p4 Fixed in 2.4.5-p3OSV source ↗3 years ago

MediumMagento incorrect permissions vulnerability in the Integrations componentGHSA-hvf5-4jr9-fghhBIT-magento-2020-24402CVE-2020-24402Affected <2.3.6, >=2.4.0 <2.4.1Fixed in 2.3.6 Fixed in 2.4.1OSV source ↗4 years ago

MediumMagento Unrestricted file upload vulnerabilityGHSA-7pr3-34rg-g53mCVE-2019-8140Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento 2 Community Edition Insufficient LoggingGHSA-x5q5-6wvf-2fpqCVE-2019-8124Affected >=2.1.0 <2.1.19, >=2.2.0 <2.2.10, >=2.3.0 <2.3.3Fixed in 2.1.19 Fixed in 2.2.10 Fixed in 2.3.3OSV source ↗4 years ago

MediumMagento Insecure Direct Object Reference (IDOR) vulnerabilityGHSA-7g5j-q8qj-8984CVE-2019-7925Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Information DisclosureGHSA-h522-94xp-2xr6CVE-2019-7929Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumInformation disclosure through processing of external XML entitiesGHSA-427g-2r83-3ccmCVE-2019-8126Affected >=2.2 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗7 years ago

MediumMagento vulnerable to stored Cross-Site Scripting (XSS)GHSA-pcrx-r49h-x2w5CVE-2025-54266Affected <2.4.6-p13, >=2.4.7-beta1 <2.4.7-p8, >=2.4.8-beta1 <2.4.8-p3, >=2.4.9-alpha1 <2.4.9-alpha3Fixed in 2.4.6-p13 Fixed in 2.4.7-p8 Fixed in 2.4.8-p3 Fixed in 2.4.9-alpha3OSV source ↗last year

MediumMagento Open Source stored Cross-Site Scripting (XSS) vulnerabilityGHSA-c89g-gq5r-2xw2BIT-magento-2024-45127CVE-2024-45127Affected <2.4.4-p11, >=2.4.5-p1 <2.4.5-p10, >=2.4.6-p1 <2.4.6-p8, >=2.4.7-beta1 <2.4.7-p3, ==2.4.5, ==2.4.6Fixed in 2.4.4-p11 Fixed in 2.4.5-p10 Fixed in 2.4.6-p8 Fixed in 2.4.7-p3OSV source ↗2 years ago

MediumMagento Open Source Cross-Site Scripting (XSS) vulnerabilityGHSA-5632-wq7m-gfq9BIT-magento-2024-34105CVE-2024-34105Affected <2.4.4-p9, >=2.4.5-p1 <2.4.5-p8, >=2.4.6-p1 <2.4.6-p6, ==2.4.5, ==2.4.6, ==2.4.7Fixed in 2.4.4-p9 Fixed in 2.4.5-p8 Fixed in 2.4.6-p6OSV source ↗2 years ago

MediumMagento Open Source allows Cross-Site Scripting (XSS)GHSA-fxcr-gvcw-hmqmCVE-2023-22249Affected >=2.4.4-p1 <=2.4.4-p2, ==2.4.4, 2.4.5 - 2.4.5-p1OSV source ↗3 years ago

MediumMagento stored cross-site scripting vulnerability in the admin consoleGHSA-h5rm-m772-6qcxBIT-magento-2021-21023CVE-2021-21023Affected <2.3.6, >=2.4.0 <2.4.1-p1Fixed in 2.3.6 Fixed in 2.4.1-p1OSV source ↗4 years ago

MediumMagento Reflected Cross-site Scripting vulnerability via 'file' parameterGHSA-jwxh-wj79-ccm6BIT-magento-2021-21029CVE-2021-21029Affected <2.3.6-p1, >=2.4.0 <2.4.2Fixed in 2.3.6-p1 Fixed in 2.4.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-86pc-6mm8-542rCVE-2019-8148Affected >=2.3.0 <2.3.2-p2Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-jjmg-xmq2-g6ffCVE-2019-8152Affected >=2.2.0 <2.2.10, >=2.3 <2.3.2-p2Fixed in 2.2.10 Fixed in 2.3.2-p2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-29mr-gr4c-vf9cCVE-2019-8115Affected >=2.2.0 <2.2.10, >=2.3.0 <2.3.2-p1Fixed in 2.2.10 Fixed in 2.3.2-p1OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-5c4g-p858-498xCVE-2019-7935Affected >=2.1 <2.1.18, >=2.2 <2.2.9, >=2.3 <2.3.2, 2.1.0-rc1 - 2.1.0-rc3Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-77mv-p94f-qcq4CVE-2019-7934Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-94fc-rxhv-vvf8CVE-2019-7937Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-mf6x-7766-5cg8CVE-2019-7936Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-mgfr-44wv-hqv6CVE-2019-7938Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-525g-rvh4-v5c9CVE-2019-7926Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-r68f-45jg-64m6CVE-2019-7927Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition XSS VulnerabilityGHSA-jxp3-mmw7-8285CVE-2019-7897Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento Cross-site Scripting in the admin panelGHSA-mgfv-4whf-c574CVE-2019-7908Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago

MediumMagento 2 Community Edition Cross-site Scripting VulnerabilityGHSA-pw2f-m22m-p75cCVE-2019-7909Affected >=2.1.0 <2.1.18, >=2.2.0 <2.2.9, >=2.3.0 <2.3.2Fixed in 2.1.18 Fixed in 2.2.9 Fixed in 2.3.2OSV source ↗4 years ago