magento/community-edition
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Packagist
- Vulnerability status
- 299 advisory(ies) without a verdict
Advisories (299)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2444-8gj8-6fmx Magento Open Source allows XML Injection | 2.4.5-p1 – < 2.4.5-p2 ; 2.4.5 ; 2.4.4-p1 – < 2.4.4-p3 ; … | Undetermined |
| GHSA-264g-f7v8-q5qq Magento Open Source allows Cross-Site Scripting (XSS) | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-269w-pqc7-68q9 Magento vulnerable to a file upload restriction bypass | < 2.3.6-p1 ; 2.4.0 – < 2.4.2 | Undetermined |
| GHSA-26hq-7286-mg8f Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability | 1.9.0.0 – < 1.14.3.2 | Undetermined |
| GHSA-273r-v888-vgc6 Magento Cross-site Scripting (XSS) | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-274w-2j5w-m2xj Magento 2 Community Edition Information Disclosure | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-2768-5wmv-cfff Magento vulnerable to stored Cross-Site Scripting (XSS) | 2.4.9-alpha1 – < 2.4.9-alpha3 ; 2.4.8-beta1 – < 2.4.8-p3 ; 2.4.7-beta1 – < 2.4.7-p8 ; … | Undetermined |
| GHSA-28vp-39rf-3q2j Magento Open Source has Business Logic Errors Vulnerability | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-297f-r9w7-w492 Magento Improper input validation vulnerability | < 2.3.7-p4 ; 2.4.0 – < 2.4.3-p3 ; 2.4.4 – < 2.4.5 | Undetermined |
| GHSA-298q-wv2h-v5vw Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-29mr-gr4c-vf9c Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-2cg3-w597-rjfv Magento 2 Community Edition Arbitrary File Deletion | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-2crc-5vq6-386r Magento 2 Community Edition RCE Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-2ff6-837j-hg5x Magento OS Command ('OS Command Injection') vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-2fhr-f6q6-c4p2 Magento 2 Community Edition Access Control Bypass | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-2j6v-829g-885q Magento Improper Access Control | < 2.3.6 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-2pq5-gpqf-g4r3 Magento has a file extension restrictions bypass | 2.4.2 ; 2.4.2-p1 – < 2.4.2-p2 ; 2.3.7 ; … | Undetermined |
| GHSA-2qhq-fw98-h6wg Magento Open Source Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-2r94-wm5v-4prx Magento does not properly protect credentials | 2.4.7-beta1 – < 2.4.7-p5 ; 2.4.6-p1 – < 2.4.6-p10 ; 2.4.5-p1 – < 2.4.5-p12 ; … | Undetermined |
| GHSA-2w26-gmqm-mc5p Magento 2 Community Cryptographic Flaw | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-2w2x-7qgj-4x78 Magento stored cross-site scripting vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-2wm7-mmgc-qxr3 Magento Open Source allows Incorrect Authorization | 2.4.4-p1 – < 2.4.4-p3 ; 2.4.5-p1 – < 2.4.5-p2 ; 2.4.5 ; … | Undetermined |
| GHSA-2x2q-2xpv-mcf9 Magento 2 Community Edition SQLi Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-2x55-mg9r-24f7 Magento 2 Community Edition RCE Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-32x5-6p4q-q8jh Magento Information Disclosure via File upload functionality | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p1 | Undetermined |
| GHSA-33cj-w75f-49m2 Magento 2 Community Edition Server-Side Request Forgery vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-354h-fpmq-68v7 Magento Open Source allows Incorrect Authorization | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-36hw-x3cc-m258 Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-36xq-7w8w-xp68 Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-39ch-rg26-gmq5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-39rw-4m66-82gf Magento incorrect user permissions vulnerability within the Inventory component | < 2.3.6 ; 2.4.0 – < 2.4.1 | Undetermined |
| GHSA-3ccx-7588-r6c6 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-3cfg-w257-cgf8 Magento Information Exposure vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-3f97-7pgv-gmgr Magento affected by a business logic error in the placeOrder graphql mutation | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-3fr3-gcqh-3m2g Magento Open Source Improper Input Validation vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-3g7m-g8qm-x6j5 Magento discloses sensitive information | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-3h69-4frw-g2jm Magento 2 Community Unrestricted File Upload | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-3j7w-jp46-9752 Magento Open Source allows Cross-Site Scripting (XSS) | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-3mxq-v9rw-m6x9 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-3pgc-7jf3-5x5g Magento 2 Community Edition IDOR Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-3q5x-7mxp-rp6j Remote code execution via vulnerable Symphony dependecy injection | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-3qr4-w96f-672v Magento Open Source allows Incorrect Authorization | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-3vg2-v639-6ch9 Magento Open Source allows Incorrect Authorization | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-3x9x-vhqj-cv27 Magento XML Injection vulnerability in the Widgets Update Layout | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-427g-2r83-3ccm Information disclosure through processing of external XML entities | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-4323-f82v-f6jr Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | 2.4.7-p1 – < 2.4.7-p2 ; 2.4.7 ; 2.4.6-p1 – < 2.4.6-p7 ; … | Undetermined |
| GHSA-4588-7x48-jrgj Magento Open Source allows Server-Side Request Forgery (SSRF) | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-45gj-78hc-4mvc Magento SQL injection via marketing account with access to email templates variables | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p1 | Undetermined |
| GHSA-45h4-6gcj-6hwv Magento Stored cross-site scripting | 2.3.0 – < 2.3.4-p2 ; < 2.2.12 | Undetermined |
| GHSA-469f-wf4f-3jjv Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-46fm-x82m-5f74 Magento Open Source Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-47h6-hfpv-7phj Magento 2 Community Edition RCE Vulnerability | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-47jp-46c9-25vf Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-4cj6-f32v-6hgx Magento Open Source Cross-Site Request Forgery vulnerability | 2.4.7-p1 – < 2.4.7-p2 ; 2.4.7 ; 2.4.6-p1 – < 2.4.6-p7 ; … | Undetermined |
| GHSA-4f7x-gjqc-qqpg Magento command injection vulnerability | 2.3.0 – < 2.3.4-p2 ; < 2.2.12 | Undetermined |
| GHSA-4f89-5cwm-rm5g Magento Open Source Information Exposure vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-4g27-q2w9-m8m8 Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-4h3p-63x6-vwg2 Magento Insufficient Session Expiration | 2.4.0 – < 2.4.1-p1 ; < 2.3.6 | Undetermined |
| GHSA-4h7p-4vq8-g2gh Magento Open Source allows Improper Access Control | 2.4.4-p1 – < 2.4.4-p3 ; 2.4.4 ; 2.4.5 ; … | Undetermined |
| GHSA-4j6w-9rf8-hg7r Magento 2 Community Edition SQLi Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-4jfq-f8hc-775q Magento Insufficient Session Expiration | 2.4.0 – < 2.4.1-p1 ; < 2.3.6 | Undetermined |
| GHSA-4v2q-hjx3-c4vr Magento remote code execution vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-4vj2-426r-jm3g Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | 2.4.4-p1 ; 2.4.4 ; 2.4.5 ; … | Undetermined |
| GHSA-4xgg-rw35-7mv5 Magento Improper Authorization leads to Security feature bypass | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-4xmj-f664-hv98 Magento Improper Authorization leads to Security feature bypass | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-525f-pvj5-vqmq Magento Open Source allows OS Command Injection | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-525g-rvh4-v5c9 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-52fg-wjxm-pp44 Magento DOM-based Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-539v-w87w-w62c Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-55gv-hfg3-hwjq Magento Defense-in-depth security mitigation vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-5632-wq7m-gfq9 Magento Open Source Cross-Site Scripting (XSS) vulnerability | 2.4.7 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-56hf-w8gm-448q Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-5777-jj7p-mpqw Magento Cross-Site Request Forgery (CSRF) vulnerability | 2.4.9-alpha1 – < 2.4.9-alpha2 ; 2.4.8-beta1 – < 2.4.8-p2 ; 2.4.7-beta1 – < 2.4.7-p7 ; … | Undetermined |
| GHSA-59vf-hjxc-f9c5 Magento Open Source allows Cross-Site Scripting (XSS) | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-5c4g-p858-498x Magento 2 Community Edition XSS Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-5f64-ppmg-cvvm Magento Open Source Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-5f79-vhr4-vw2r Magento Open Source allows Server-Side Request Forgery (SSRF) | 2.4.6 ; 2.4.5-p1 – < 2.4.5-p3 ; 2.4.4-p1 – < 2.4.4-p4 ; … | Undetermined |
| GHSA-5fxx-jwjm-x9hj Magento Open Source allows Improper Access Control | 2.4.4-p1 – < 2.4.4-p2 ; 2.4.4 ; 2.4.5 ; … | Undetermined |
| GHSA-5g9f-7gqc-8hj4 Magento Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-5gmh-85x8-5cx7 Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities | 2.1 – < 2.1.14 ; 2.2 – < 2.2.5 | Undetermined |
| GHSA-5hcx-vg88-hgpm Magento 2 Community Edition Insufficient Access Controls | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-5j25-5hjr-w7m2 Magento 2 Community Edition Information Leak | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-5j4w-v87m-8r65 Magento business logic error vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-5jfg-phx7-7fxg Magento Open Source affected by Improper Input Validation | 2.4.6 ; 2.4.5-p1 – < 2.4.5-p3 ; 2.4.4-p1 – < 2.4.5-p4 ; … | Undetermined |
| GHSA-5m55-g8pv-x8ww Magento stored Cross-Site Scripting (XSS) vulnerability | 2.3.0 – < 2.3.7-p4 ; 2.4.4 – < 2.4.5 ; 2.4.0 – < 2.4.3-p3 | Undetermined |
| GHSA-5pjj-7fq8-9gpf Magento has an XML Injection vulnerability | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-5v5p-x8c2-mqxp Magento 2 Community Edition RCE Vulnerability | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-5vw8-r55w-f4q4 Magento is affected by an improper input validation vulnerability | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-5xmp-7wg5-x68q Magento Open Source affected by Improper Input Validation | 2.4.3 ; 2.3.7 ; 2.4.3-p1 – < 2.4.3-p2 ; … | Undetermined |
| GHSA-62fx-3v4f-mwxm Bypass of sitemp access restrictions | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-653q-vqm6-gmjm Magento 2 Community Edition Arbitrary File Deletion | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-656q-fx2w-8ccv Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-66c9-xrwj-9xv6 Magento Open Source affected by Improper Input Validation | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-689w-2f93-2x67 Magento stored cross-site scripting vulnerability | < 2.3.4-p2 | Undetermined |
| GHSA-6988-g89m-27vf Magento stored cross-site scripting (XSS) in the customer address upload feature | < 2.3.6 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-69x9-xp2j-w8g8 Magento provides incorrect authorization through a security feature bypass | 2.4.9-alpha1 – < 2.4.9-alpha3 ; 2.4.8-beta1 – < 2.4.8-p3 ; 2.4.7-beta1 – < 2.4.7-p8 ; … | Undetermined |
| GHSA-6cwv-wj7v-73xp Magento executes code via the API File Option Upload Extension | 2.4.2 ; 2.4.2-p1 – < 2.4.2-p2 ; 2.3.7 ; … | Undetermined |
| GHSA-6ff8-jrfg-43hh Magento Business Logic Error vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-6m27-3r8q-c7f7 Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-6pxh-2557-5cj5 Magento Open Source Path Traversal vulnerability | 2.4.7-p1 – < 2.4.7-p2 ; 2.4.7 ; 2.4.6-p1 – < 2.4.6-p7 ; … | Undetermined |
| GHSA-6qh6-v99h-vh4c Magento 2 Community Edition RCE Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-6vc8-3xf2-qrxx Magento 2 Community Edition RCE Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-6w27-c66f-gvhq Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-6w29-x5j4-qhrw Magento security mitigation bypass vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-6wm4-3rjj-c8xx Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities | 1.5.0.0 – < 1.9.4.0 | Undetermined |
| GHSA-6wq7-cg9h-mj6q Magento Improper Access Control leads to Security feature bypass | 2.4.7-beta1 – < 2.4.7-p5 ; 2.4.6-p1 – < 2.4.6-p10 ; 2.4.5-p1 – < 2.4.5-p12 ; … | Undetermined |
| GHSA-724x-gqhv-9c5x Magento command injection vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-7472-vw39-g2j3 Magento Open Source Improper Authorization vulnerability | 2.4.7-p1 – < 2.4.7-p2 ; 2.4.7 ; 2.4.6-p1 – < 2.4.6-p7 ; … | Undetermined |
| GHSA-74w7-cr4v-wf2v Magento Improper Access Control Leads to Privilege escalation | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-775w-gx3f-4j4f Magento 2 Community Edition SSRF vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-77mv-p94f-qcq4 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-792f-c8mp-2cr5 Magento OS command injection via the WebAPI | < 2.3.6-p1 ; 2.4.0 – < 2.4.2 | Undetermined |
| GHSA-7g5j-q8qj-8984 Magento Insecure Direct Object Reference (IDOR) vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-7gh6-f4jh-3crq Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-7gpv-xrjr-f5h4 Magento Path Traversal vulnerability | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-7h8v-f2g9-39fx Magento 2 Community Edition Cryptographic Flaw | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-7hrj-3c9x-xv5h Magento has incorrect authorization issue that leads to arbitrary file system read | 2.4.9-alpha1 – < 2.4.9-alpha2 ; 2.4.8-beta1 – < 2.4.8-p2 ; 2.4.7-beta1 – < 2.4.7-p7 ; … | Undetermined |
| GHSA-7jmr-43qj-pw47 Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-7pfc-834q-h497 Magento Open Source allows Uncontrolled Resource Consumption | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.7 ; 2.4.6 ; … | Undetermined |
| GHSA-7pr3-34rg-g53m Magento Unrestricted file upload vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-7pxg-6p87-8c9v Magento 2 Community Edition RCE via Unsafe File Upload | < 2.4.1 | Undetermined |
| GHSA-7r99-8wqp-h7pc Magento Path Traversal vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-7w95-qwhh-q9p3 Magento Path Traversal vulnerability via the `theme[preview_image]` parameter | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-7xqv-jgv6-x2h8 Magento 2 Community Edition XSS Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-82p4-55gj-956p Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; < 2.4.4-p12 ; … | Undetermined |
| GHSA-8578-mmf4-f327 Magento 2 Community Edition Cross-site Scripting Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-85jx-x9r4-45m2 Magento Authenticated Security feature bypass | 2.4.7-beta1 – < 2.4.7-p6 ; 2.4.6-p1 – < 2.4.6-p11 ; < 2.4.5-p13 ; … | Undetermined |
| GHSA-85m4-g9vq-xpxj Magento Open Source allows Information Exposure | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-85xw-3hp5-6fmc Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-86pc-6mm8-542r Magento 2 Community Edition XSS Vulnerability | 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-873m-72g6-853g Magento Open Source Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-874g-pxqp-frqp Magento Path Traversal | 2.2.0 – < 2.2.11 ; 2.3.0 – < 2.3.4 | Undetermined |
| GHSA-8884-7rm9-mrx4 Magento stored Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-88x2-cq34-5fwc Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-89ch-hqf9-rgp3 Using JS libraries with known security vulnerabilities | 2.2 – < 2.2.10 ; 2.3 – < 2.3.3 | Undetermined |
| GHSA-8cjg-f53m-8m9q Magento XML Injection vulnerability in the Widgets Update Layout | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-8frp-pxq2-3gpq Magento OS Command ('OS Command Injection') vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-8gfq-m4cf-w975 Magento stored cross-site scripting vulnerability in the customer address upload feature | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-8hcx-xvww-6c6h Magento Security feature bypass | 2.4.7-beta1 – < 2.4.7-p6 ; 2.4.6-p1 – < 2.4.6-p11 ; < 2.4.5-p13 ; … | Undetermined |
| GHSA-8j7c-682x-r9f2 Magento RCE,XSS and other vulnerabilities | 2.1 – < 2.1.16 ; 2.2 – < 2.2.7 | Undetermined |
| GHSA-8jxc-5f94-22vh Magento Open Source allows Server-Side Request Forgery (SSRF) | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.7 ; 2.4.6 ; … | Undetermined |
| GHSA-8mq8-c243-2335 Magento Cross-site Scripting vulnerability | < 2.4.4-p15 ; 2.4.5-p1 – < 2.4.5-p14 ; 2.4.6-p1 – < 2.4.6-p12 ; … | Undetermined |
| GHSA-8mwx-wpp4-5xh4 Magento Broken authentication and session managememt | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p1 | Undetermined |
| GHSA-8p5c-f836-m4h7 Magento 2 Community Edition XML Injection | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-8pfq-g48p-x7w8 Magento Insecure Direct Object Reference (IDOR) in the product module | < 2.3.6-p1 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-8pxg-gcp4-57ww Magento Open Source Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-8v75-8jj8-77gf Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-8v9h-m7pj-hx7c Magento 2 Community Edition Weak PRNG | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-8w5f-8992-g86j Magento Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-8wm7-h2qh-ff4c Magento authorization bypass vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-92ph-xm9v-cg3j Magento Broken authentication and session managememt | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-94fc-rxhv-vvf8 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-94q8-gx29-6mqv Magento Injection vulnerability via email templates | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p1 | Undetermined |
| GHSA-94wq-87g6-8h77 Magento Open Source allows Cross-Site Request Forgery (CSRF) | 2.4.2-p1 – 2.4.2-p2 ; 2.4.3 ; < 2.3.7-p2 ; … | Undetermined |
| GHSA-954p-ff72-327w Adobe Commerce Path Traversal | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-969v-mwp3-4mr3 Magento 2 Community Edition RCE Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-985w-mqqp-7287 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-9f4p-3jgf-98f5 Magento Stored Cross-site Scripting vulnerability in the admin panel | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-9mx6-4gg4-85xj Magento Open Source has Improper Input Validation Vulnerability | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.7 ; 2.4.6 ; … | Undetermined |
| GHSA-9pgc-rvp9-rqv3 Magento 2 Community Edition Information Disclosure | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-9wc9-498w-h8xv Magento deserialization vulnerability | 2.2.0 – < 2.2.11 ; 2.3.0 – < 2.3.4 | Undetermined |
| GHSA-9wjf-94h3-r4rh Magento Improper Access Control vulnerability | 2.3.0 – < 2.3.7-p4 ; 2.4.4 – < 2.4.5 ; 2.4.0 – < 2.4.3-p3 | Undetermined |
| GHSA-9wr9-fw9v-8fgr Magento 2 Community Edition RCE Vulnerability | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-c2gg-rrhc-fvvg Magento 2 Community Edition Cryptographic Flaw | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-c33v-23rx-7qqc Magento 2 Community Edition IDOR Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-c38m-9668-6j2w Magento Improper input validation vulnerability | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-c3m4-hxv9-4mxj Magento command injection vulnerability | 2.3.0 – < 2.3.4-p2 ; < 2.2.12 | Undetermined |
| GHSA-c45w-p293-7cv6 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-c4r2-3f9r-rwp8 Magento 2 Community Weak PRNG | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-c55h-7q4j-g6rq Magento command injection vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-c89g-gq5r-2xw2 Magento Open Source stored Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-c9h9-h5gf-885r Magento Open Source allows Uncontrolled Resource Consumption | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-cc3w-r3w8-hfh7 Magento Improper Authorization vulnerability in the customers module | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-ccjm-rgm5-rjjh Magento 2 Community Edition XSS Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-cg52-68fv-94qq Magento Open Source Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-cj7w-pm77-hvg6 Magento XML Injection vulnerability in the Widgets Module | < 2.3.7-p4 ; 2.4.4 – < 2.4.5 ; 2.4.0 – < 2.4.3-p3 | Undetermined |
| GHSA-cjm6-8mw8-2f8c Magento Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-crjc-2v9m-8w7r Magento improper authorization vulnerability in the integrations module | < 2.3.6-p1 ; 2.4.0 – < 2.4.2 | Undetermined |
| GHSA-crv7-r357-gw3w Magento 2 Community Edition RCE Vulnerability | < 1.9.4.3 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-cv25-3pxr-4q7x Magento Open Source Security Advisory: Patch SUPEE-10975 | 1.9.0.0 – < 1.14.4.0 | Undetermined |
| GHSA-f2g3-3c6q-4478 Magento 2 Community Edition Incorrect Authorization | < 2.4.1 | Undetermined |
| GHSA-f6ww-vqw2-xp3v Magento Cross-Site Request Forgery (CSRF) | 2.2.0 – < 2.2.9 ; 2.1.0 – < 2.1.18 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-f73h-224c-62qr Magento Server-Side Request Forgery (SSRF) | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-f7q4-9gwv-6774 Magento Open Source Improper Authentication vulnerability | 2.4.7 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-f8fv-f786-9933 Magento improper input validation vulnerability | 2.3.3-p1 – < 2.3.7-p3 ; 2.4.0 – < 2.4.3-p2 | Undetermined |
| GHSA-f8h9-7rpq-7qcc Magento Filter extension bypass via crafted store configuration keys | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-f989-3fp9-q3r2 Magento Open Source allows Incorrect Authorization | 2.4.6 ; 2.4.5-p1 – < 2.4.5-p3 ; 2.4.4-p1 – < 2.4.4-p4 ; … | Undetermined |
| GHSA-ff7r-7rrm-wx6w Magento 2 Community Edition XSS Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-fhw6-3mj5-w9gv Magento Stored Cross-Site Scripting (XSS) Vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-fm68-89m8-4gjj Composer JavaScript injection possible via html comments | 2.2 – < 2.2.10 ; 2.3 – < 2.3.3 | Undetermined |
| GHSA-fp5m-4mqh-849p Magento 2 Community Edition Insufficient Logging | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-fppq-f2m6-xv5c Improper Authorization vulnerability in Magento and Adobe Commerce | 2.4.8-beta1 – < 2.4.8-beta2 ; 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; … | Undetermined |
| GHSA-fr6f-xmfx-rrpq Magento path traversal vulnerability | < 2.3.5-p2 | Undetermined |
| GHSA-fx9g-g9q6-x3jx Magento Path Traversal vulnerability | 2.3.0 – < 2.3.7-p4 ; 2.4.0 – < 2.4.3-p3 ; 2.4.4 – < 2.4.5 | Undetermined |
| GHSA-fxcr-gvcw-hmqm Magento Open Source allows Cross-Site Scripting (XSS) | 2.4.4 ; 2.4.5 ; 2.4.4-p1 – 2.4.4-p2 ; … | Undetermined |
| GHSA-g2pj-xmxq-3r9q Magento Improper Access Control leads to security feature bypass | 2.4.7-beta1 – < 2.4.7-p6 ; 2.4.6-p1 – < 2.4.6-p11 ; < 2.4.5-p13 ; … | Undetermined |
| GHSA-g378-6fg4-gx3v Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-g3j6-9753-8mp2 Magento Stored Cross-Site Scripting (XSS) Vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-g4jh-vxqm-6fff Magento Cross-site Scripting in the admin panel | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-g7pc-799q-743f Magento DOM-based Cross-site scripting vulnerability | < 2.3.5-p2 | Undetermined |
| GHSA-g9fm-wc6h-pvgj Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-gc27-rvvm-q77r Magento Stored Cross-Site Scripting (XSS) Vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-gfcq-wh3g-c6h4 Magento 2 Community Edition RCE Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-gffx-9f36-r8wp Magento security mitigation bypass vulnerability | 2.3.0 – < 2.3.4-p2 ; ≤ 2.2.11 | Undetermined |
| GHSA-gfmm-ww6f-5mm5 Magento Open Source allows Improper Neutralization of Special Elements Used | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-gg96-8w9x-7rx9 Magento 2 Community Edition Cross-site Scripting Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-ggr8-3hwx-4f2m Magento Open Source allows SQL Injection | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-ghpr-6qhr-rpp8 Magento Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-gj93-84g5-mcjq Magento Improper Authorization Leading to Security feature bypass | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-gjjm-4x3g-3h33 Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-gjxp-46rq-wg4q Magento Stored Cross-Site Scripting (XSS) Vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-gm4m-9rm8-7rxj Magento Open Source has Improper Access Control vulnerability | 2.4.3-p1 – < 2.4.3-p3 ; 2.3.7-p1 – < 2.3.7-p4 ; 2.3.7 ; … | Undetermined |
| GHSA-grc6-r6f8-xj7c Magento Open Source allows Improper Authorization | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-gvfx-9m9v-h839 Magento is affected by an improper input validation vulnerability while saving a customer's details | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-gvgf-pvh5-vjh4 Magento Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-h3g9-cwr6-hphx Magento Open Source allows SQL Injection | 2.4.7-beta1 – < 2.4.7-beta2 ; 2.4.7 ; 2.4.6 ; … | Undetermined |
| GHSA-h437-qjj9-vmq4 Magento XPath Injection | < 2.3.6-p1 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-h4f4-gv6h-x824 Magento vulnerable to path traversal | 2.4.9-alpha1 – < 2.4.9-alpha2 ; 2.4.8-beta1 – < 2.4.8-p2 ; 2.4.7-beta1 – < 2.4.7-p7 ; … | Undetermined |
| GHSA-h4xc-577p-hgj9 Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API | < 2.3.6-p1 ; 2.4.0 – < 2.4.2 | Undetermined |
| GHSA-h522-94xp-2xr6 Magento 2 Community Edition Information Disclosure | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-h5rm-m772-6qcx Magento stored cross-site scripting vulnerability in the admin console | < 2.3.6 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-h7qw-mxrm-c6h2 Unauthenticated crypto and weak IV in Magento\Framework\Encryption | 2.0 – < 2.2.6 | Undetermined |
| GHSA-hmch-9947-82rj Magento 2 Community Edition Weak Cryptography | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-hppc-rpfp-r8qw Magento 2 Community Edition SSRF vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-hpxv-vpfv-7jc9 Magento 2 Community Edition IDOR Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-hqgj-4396-hmxv Magento Open Source allows Cross-Site Request Forgery (CSRF) | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-hqhf-8jgc-h5hx Magento 2 Community Edition Path Traversal Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-hrg3-4q56-p2q5 Magento 2 Community Edition DoS vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-hvcp-jvx5-4pmp Magento 2 Community Edition SSRF vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-hvf5-4jr9-fghh Magento incorrect permissions vulnerability in the Integrations component | < 2.3.6 ; 2.4.0 – < 2.4.1 | Undetermined |
| GHSA-hxmp-jcqj-83hm Magento 2 Community Edition Injection Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-j2jp-58gv-g2pg Magento Security mitigation bypass vulnerability | ≤ 2.2.11 ; 2.3.0 – < 2.3.4-p2 | Undetermined |
| GHSA-j2r4-2cr6-h3r3 Magento Signature verification bypass | < 2.3.4-p2 | Undetermined |
| GHSA-j3mh-wx5f-2vhg Magento Open Source Information Exposure vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-j46h-qjjv-cxfj Magento affected by remote code execution via a file upload | 2.4.2 ; 2.4.2-p1 – < 2.4.2-p2 ; 2.3.7 ; … | Undetermined |
| GHSA-j63v-wcf9-c9hm Magento 2 Community Edition RCE Vulnerability | 2.1.0 – < 2.1.19 ; 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.3 | Undetermined |
| GHSA-j837-vm6w-6qcv Magento 2 Community Edition Unsafe File Upload | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-j934-vjh5-vf9r Magneto contains stored XSS vulnerability | 2.4.8-beta1 – < 2.4.8-p1 ; 2.4.7-beta1 – < 2.4.7-p6 ; < 2.4.5-p13 ; … | Undetermined |
| GHSA-jhvh-mjfg-5m99 Magento 2 Community Edition RCE Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-jjmg-xmq2-g6ff Magento 2 Community Edition XSS Vulnerability | 2.2.0 – < 2.2.10 ; 2.3 – < 2.3.2-p2 | Undetermined |
| GHSA-jmqp-r3gg-6jh3 Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | 2.4.7 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-jrjx-8gmw-jj2q Magento 2 Community Edition RCE Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-jwxh-wj79-ccm6 Magento Reflected Cross-site Scripting vulnerability via 'file' parameter | < 2.3.6-p1 ; 2.4.0 – < 2.4.2 | Undetermined |
| GHSA-jxjc-6xmh-h7mg Magento 2 Community Edition XSS Vulnerability | < 2.4.1 | Undetermined |
| GHSA-jxp3-mmw7-8285 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-m3v2-r236-5xgq Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-m4rg-mpp2-97px Magento Stored Cross-Site Scripting (XSS) Vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-m58h-998x-66f3 Magento Open Source Improper Access Control vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-m8cj-3v68-3cxj Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | 2.4.4 ; 2.4.6-p1 – < 2.4.6-p6 ; 2.4.5-p1 – < 2.4.5-p8 ; … | Undetermined |
| GHSA-m8wx-whpp-q283 Magento improper authorization vulnerability | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-mcfc-67vm-j568 Magento Cross-Site Scripting (XSS) vulnerability | 2.1 – < 2.1.15 ; 2.2 – < 2.2.6 | Undetermined |
| GHSA-mf6x-7766-5cg8 Magento 2 Community Edition XSS Vulnerability | 2.3.0 – < 2.3.2 ; 2.2.0 – < 2.2.9 ; 2.1.0 – < 2.1.18 | Undetermined |
| GHSA-mgfr-44wv-hqv6 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-mgfv-4whf-c574 Magento Cross-site Scripting in the admin panel | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-mgg3-v948-2vgr Magento stored cross-site scripting vulnerability | 2.3.0 – < 2.3.4 ; < 2.2.11 | Undetermined |
| GHSA-mhvf-j94g-3qp7 Magento 2 Community Edition CSRF vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-mhwc-4w67-xq2c Magento Cross-Site Scripting via store name | 2.2 – < 2.2.10 ; 2.3 – < 2.3.2-p1 | Undetermined |
| GHSA-mjgf-xmrr-6gvx Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-mm87-rrqx-94cr Magento stored Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p4 ; 2.4.6-p1 – < 2.4.6-p9 ; 2.4.5-p1 – < 2.4.5-p11 ; … | Undetermined |
| GHSA-mmp7-8cg4-9wrg Magento Stored Cross-Site Scripting (XSS) vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-mp9r-rh95-f8f8 Magento 2 Community Edition RCE Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-mr8q-7f5j-wc79 Magento information disclosure vulnerability | < 2.3.6 ; 2.4.0 – < 2.4.1 | Undetermined |
| GHSA-mw5w-cf76-73m8 Magento 2 Community Edition RCE Vulnerability | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-mw95-gmw4-883p Magento XML injection in the Widgets module | < 2.3.6-p1 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-mx5m-j5xr-jg8c Magento vulnerable to file upload attack | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-mxc9-g6m4-2v35 Magento Open Source allows Improper Neutralization of Special Elements Used | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-p5q3-xg47-653m Magento stored cross-site scripting vulnerability | 2.3.0 – < 2.3.4 ; < 2.2.11 | Undetermined |
| GHSA-p6h9-gx5g-wg64 Magento Open Source Incorrect Authorization vulnerability | 2.4.7 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-p746-qw73-qmmx Magento XML Injection vulnerability in the Widgets Module | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-p783-gj6m-9r88 Magento 2 Community Edition RCE Vulnerability | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p2 | Undetermined |
| GHSA-p7m7-j8jv-393q Magento incorrect permissions vulnerability in the Inventory module | < 2.3.6 ; 2.4.0 – < 2.4.1 | Undetermined |
| GHSA-p8gw-x2p7-vc73 Magento Stored cross-site scripting in admin panel | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-p9vf-4jx2-5hpp Magento 2 Community Edition Security Bypass | 2.2.0 – < 2.2.10 ; 2.3.0 – < 2.3.2-p1 | Undetermined |
| GHSA-pcrx-r49h-x2w5 Magento vulnerable to stored Cross-Site Scripting (XSS) | 2.4.9-alpha1 – < 2.4.9-alpha3 ; 2.4.8-beta1 – < 2.4.8-p3 ; 2.4.7-beta1 – < 2.4.7-p8 ; … | Undetermined |
| GHSA-pf6w-3pfw-fxvw Magento SQL Injection vulnerability | < 2.3.6 ; 2.4.0 – < 2.4.1 | Undetermined |
| GHSA-pfxv-66r9-4gqw Magento Insufficient authorization check when adding users to company accounts | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-prpf-cj87-hwvr Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities | < 1.9.3.9 | Undetermined |
| GHSA-prw8-gqwp-f7fh Magento 2 Community Edition DoS vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-pw2f-m22m-p75c Magento 2 Community Edition Cross-site Scripting Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-q628-54wg-4r5q Magento does not properly restrict excessive authentication attempts | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-q9xx-4689-gvv5 Magento Unauthorized access to restricted resources | 2.4.0 – < 2.4.2-p1 ; < 2.3.7 | Undetermined |
| GHSA-qm77-mqf3-fmhq Magento Improper Authorization leads to security feature bypass | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-qmq6-jpvg-j547 Magento is affected by an os command injection via the Data collection endpoint | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-qmwh-rh2g-3682 Magento 2 Community Edition Cross-site Scripting Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-qpp7-742q-58j3 Magento Open Source Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p3 ; 2.4.6-p1 – < 2.4.6-p8 ; 2.4.5-p1 – < 2.4.5-p10 ; … | Undetermined |
| GHSA-qrh3-vxjg-h9h6 Magento Improper Authorization vulnerability | 2.4.7-beta1 – < 2.4.7-p2 ; 2.4.6-p1 – < 2.4.6-p7 ; 2.4.5-p1 – < 2.4.5-p9 ; … | Undetermined |
| GHSA-qvwr-p3hj-j6jf Magento vulnerable to privilege escalation due to incorrect authorization | 2.4.9-alpha1 – < 2.4.9-alpha3 ; 2.4.8-beta1 – < 2.4.8-p3 ; 2.4.7-beta1 – < 2.4.7-p8 ; … | Undetermined |
| GHSA-qw5m-vmp3-f553 Magento Open Source allows Incorrect Authorization | 2.4.6 ; 2.4.5 ; 2.4.4 ; … | Undetermined |
| GHSA-r355-75hw-r8jf Magento allows incorrect authorization | 2.4.9-alpha1 – < 2.4.9-alpha3 ; 2.4.8-beta1 – < 2.4.8-p3 ; 2.4.7-beta1 – < 2.4.7-p8 ; … | Undetermined |
| GHSA-r487-9vv5-75gg Magento Improper Authorization leading to security feature bypass | 2.4.7-beta1 – < 2.4.7-p6 ; 2.4.6-p1 – < 2.4.6-p11 ; < 2.4.5-p13 ; … | Undetermined |
| GHSA-r68f-45jg-64m6 Magento 2 Community Edition XSS Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
| GHSA-r728-jwf5-f5r5 Magento Reflected cross-site scripting on customer cart page | 2.1 – < 2.1.18 ; 2.2 – < 2.2.9 ; 2.3 – < 2.3.2 | Undetermined |
| GHSA-r7cm-g469-wm4g Magento Open Source Improper Access Control vulnerability | 2.4.7 ; 2.4.6 ; 2.4.5 ; … | Undetermined |
| GHSA-r7mm-grf3-5fjv Magento Improper Authorization vulnerability | 2.3.0 – < 2.3.7-p4 ; 2.4.4 – < 2.4.5 ; 2.4.0 – < 2.4.3-p3 | Undetermined |
| GHSA-rf4q-m23c-7q8r Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability | 2.4.7-p1 – < 2.4.7-p2 ; 2.4.7 ; 2.4.6-p1 – < 2.4.6-p7 ; … | Undetermined |
| GHSA-rg7p-wmgj-f374 Magento stored Cross-Site Scripting (XSS) vulnerability | 2.3.0 – < 2.3.7-p4 ; 2.4.4 – < 2.4.5 ; 2.4.0 – < 2.4.3-p3 | Undetermined |
| GHSA-rhff-65hp-55rw Magento allows attackers to alter the price of items | < 2.3.7-p1 ; 2.3.7 ; 2.4.2-p1 – < 2.4.2-p2 ; … | Undetermined |
| GHSA-rj4f-cp4v-hvcv Magento Blind SQL Injection in the Search module | < 2.3.6-p1 ; 2.4.0 – < 2.4.1-p1 | Undetermined |
| GHSA-rj8f-g5gm-jw5c Magento 2 Community Edition Cross-site Scripting Vulnerability | 2.1.0 – < 2.1.18 ; 2.2.0 – < 2.2.9 ; 2.3.0 – < 2.3.2 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-988g-wfwf-5666 Withdrawn Advisory: Magento 2 Community Edition XSS Vulnerability · withdrawn
Sources
| Source | Licence |
|---|