Sign in
Deutsch English Español Polski
Critical

Magento Open Source Security Advisory: Patch SUPEE-10975

  • Disclosed: 15.05.2024
  • Updated: 11.10.2026 11:18

Magento Commerce 1.14.4.0 and Open Source 1.9.4.0 have been enhanced with critical security updates to address multiple vulnerabilities, including remote code execution (RCE), cross-site scripting (XSS), cross-site request forgery (CSRF), and more. The following issues have been identified and remediated:

  • PRODSECBUG-1589: Stops Brute Force Requests via basic RSS authentication
  • MAG-23: M1 Credit Card Storage Capability
  • PRODSECBUG-2149: Authenticated RCE using customer import
  • PRODSECBUG-2159: API Based RCE Vulnerability
  • PRODSECBUG-2156: RCE Via Unauthorized Upload
  • PRODSECBUG-2155: Authenticated RCE using dataflow
  • PRODSECBUG-2053: Prevents XSS in Newsletter Template
  • PRODSECBUG-2142: XSS in CMS Preview
  • PRODSECBUG-1860: Admin Account XSS Attack Cessation via Filename
  • PRODSECBUG-2119: EE Patch to include names in templates
  • PRODSECBUG-2129: XSS in Google Analytics Vulnerability
  • PRODSECBUG-2019: Merchant Wishlist Security Strengthening
  • PRODSECBUG-2104: Send to a Friend Vulnerability
  • PRODSECBUG-2125: CSRF on deletion of Blocks Vulnerability
  • PRODSECBUG-2088: CSRF Vulnerability related to Customer Group Deletion
  • PRODSECBUG-2140: CSRF on deletion of Site Map
  • PRODSECBUG-2108: Outdated jQuery causing PCI scanning failures
  • MAG-12, MAG-2: Encryption Keys Stored in Plain Text
  • PRODSECBUG-2141: Unauthorized Admin Panel Bypass

Patching and Upgrading:

Patches and upgrades are available for the following Magento versions:

Magento Commerce 1.9.0.0-1.14.4.0: Apply SUPEE-10975 or upgrade to Magento Commerce 1.14.4.0. Magento Open Source 1.5.0.0-1.9.4.0: Apply SUPEE-10975 or upgrade to Magento Open Source 1.9.4.0.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0
Magento (core) magento/community-edition >= 1.9.0.0, < 1.14.4.0 1.14.4.0

References

CVSS score -
Weakness (CWE)
-
Platform
Composer, Magento
Package
magento/community-edition
Disclosed
15.05.2024
Updated
11.10.2026 11:18

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cv25-3pxr-4q7x - CC BY 4.0

Vulnerability history: magento/community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (360) in the archive
Total entries
360
First → latest
11.2019 10.2025
Without a fix
3
Exploited in attacks
3

Severity breakdown

  • Critical 47
  • High 104
  • Medium 192
  • Low 17

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 >= 2.4.9-alpha1, < 2.4.9-alpha3, >= 2.4.8-beta1, < 2.4.8-p3, >= 2.4.7-beta1, < 2.4.7-p8, < 2.4.6-p13, = 2.4.8, = 2.4.7, = 2.4.6 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 >= 2.4.9-alpha1, < 2.4.9-alpha2, >= 2.4.8-beta1, < 2.4.8-p2, >= 2.4.7-beta1, < 2.4.7-p7, >= 2.4.6-p1, < 2.4.6-p12, < 2.4.5-p14, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 < 2.4.4-p15, >= 2.4.5-p1, < 2.4.5-p14, >= 2.4.6-p1, < 2.4.6-p12, >= 2.4.7-p1, < 2.4.7-p7, = 2.4.8 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 >= 2.4.7-beta1, < 2.4.7-p6, >= 2.4.6-p1, < 2.4.6-p11, < 2.4.5-p13, = 2.4.5, = 2.4.6, = 2.4.7, = 2.4.8 2.4.7-p6, 2.4.6-p11, 2.4.5-p13
  9. Magneto contains stored XSS vulnerability
    Critical · 9.1 CVE-2025-47110 >= 2.4.8-beta1, < 2.4.8-p1, >= 2.4.7-beta1, < 2.4.7-p6, < 2.4.5-p13, >= 2.4.6-p1, < 2.4.6-p11, = 2.4.7, = 2.4.8, = 2.4.5, = 2.4.6 2.4.8-p1, 2.4.7-p6, 2.4.5-p13, 2.4.6-p11
  10. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 >= 2.4.8-beta1, < 2.4.8-beta2, >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  12. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  13. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  20. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
  22. Magento Open Source Improper Authorization vulnerability
    High · 6.5 CVE-2024-45132 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  23. Magento Open Source Improper Access Control vulnerability
    High · 6.5 CVE-2024-45118 >= 2.4.7-beta1, < 2.4.7-p3, >= 2.4.6-p1, < 2.4.6-p8, >= 2.4.5-p1, < 2.4.5-p10, < 2.4.4-p11, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11
  24. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  25. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  26. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  27. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  28. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  29. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 >= 2.4.7-beta1, < 2.4.7-p2, >= 2.4.6-p1, < 2.4.6-p7, >= 2.4.5-p1, < 2.4.5-p9, >= 2.4.4-p1, < 2.4.4-p10, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10
  30. Magento Open Source Improper Authentication vulnerability
    Critical · 8.1 CVE-2024-34103 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  31. Magento Open Source Improper Authorization vulnerability
    High · 8.2 CVE-2024-34104 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  32. Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
    Critical · 9.8 Exploited in attacks CVE-2024-34102 >= 2.4.6-p1, < 2.4.6-p6, >= 2.4.5-p1, < 2.4.5-p8, < 2.4.4-p9, = 2.4.4, = 2.4.5, = 2.4.6, = 2.4.7 2.4.6-p6, 2.4.5-p8, 2.4.4-p9
  33. Magento RCE,XSS and other vulnerabilities
    Critical ghsa-8j7c-682x-r9f2 >= 2.1, < 2.1.16, >= 2.2, < 2.2.7 2.1.16, 2.2.7
  34. Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
    Critical ghsa-5gmh-85x8-5cx7 >= 2.1, < 2.1.14, >= 2.2, < 2.2.5 2.1.14, 2.2.5
  35. Magento Open Source Security Advisory: Patch SUPEE-10975 this entry
    Critical ghsa-cv25-3pxr-4q7x >= 1.9.0.0, < 1.14.4.0 1.14.4.0
  36. Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
    Critical ghsa-26hq-7286-mg8f >= 1.9.0.0, < 1.14.3.2 1.14.3.2
  37. Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
    Critical ghsa-6wm4-3rjj-c8xx >= 1.5.0.0, < 1.9.4.0 1.9.4.0
  38. Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities
    Critical ghsa-prpf-cj87-hwvr < 1.9.3.9 1.9.3.9
  39. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 >= 2.4.7-beta1, < 2.4.7, >= 2.4.6-p1, < 2.4.6-p5, >= 2.4.5-p1, < 2.4.5-p7, >= 2.4.4-p1, < 2.4.4-p8, = 2.4.6, = 2.4.5, = 2.4.4 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
  40. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  41. Magento Open Source allows Cross-Site Scripting (XSS)
    High · 9.1 CVE-2024-20719 >= 2.4.6-p1, < 2.4.6-p4, >= 2.4.5-p1, < 2.4.5-p6, >= 2.4.4-p1, < 2.4.4-p7, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p4, 2.4.5-p6, 2.4.4-p7
  42. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  43. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  44. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  45. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 >= 2.4.6-p1, < 2.4.6-p2, >= 2.4.5-p1, < 2.4.5-p4, >= 2.4.4-p1, < 2.4.4-p5, = 2.4.6, = 2.4.5, = 2.4.4 2.4.6-p2, 2.4.5-p4, 2.4.4-p5
  46. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-29297 >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
  47. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 >= 2.4.5-p1, < 2.4.5-p2, >= 2.4.4-p1, < 2.4.4-p3, = 2.4.5, = 2.4.4 2.4.5-p2, 2.4.4-p3
  48. Magento Improper input validation vulnerability
    High · 8.8 CVE-2022-42344 < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  49. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 >= 2.4.3-p1, <= 2.4.3-p3, = 2.4.4-p1, = 2.4.4, = 2.4.5, = 2.4.3 no fix
  50. Magento Path Traversal vulnerability
    High · 8.5 CVE-2022-34254 >= 2.3.0, < 2.3.7-p4, >= 2.4.0, < 2.4.3-p3, >= 2.4.4, < 2.4.5 2.3.7-p4, 2.4.3-p3, 2.4.5
  51. Magento Improper Access Control vulnerability
    High · 8.8 CVE-2022-34255 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  52. Magento Improper Authorization vulnerability
    High · 7.5 CVE-2022-34256 >= 2.3.0, < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  53. Magento XML Injection vulnerability in the Widgets Module
    Critical · 9.1 CVE-2022-34253 < 2.3.7-p4, >= 2.4.4, < 2.4.5, >= 2.4.0, < 2.4.3-p3 2.3.7-p4, 2.4.5, 2.4.3-p3
  54. Magento Broken authentication and session managememt
    Critical · 9.8 CVE-2019-8149 >= 2.2, < 2.2.10, >= 2.3, < 2.3.2-p1 2.2.10, 2.3.2-p1
  55. Magento remote code execution vulnerability
    High · 8.8 CVE-2019-8154 >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.2-p2 2.2.10, 2.3.2-p2
  56. Magento 2 Community Edition SQLi Vulnerability
    Critical · 9.8 CVE-2019-7139 >= 2.1.0, < 2.1.18, >= 2.2.0, < 2.2.9, >= 2.3.0, < 2.3.2 2.1.18, 2.2.9, 2.3.2
  57. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  58. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  59. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
  60. Magento has an XML Injection vulnerability
    Critical CVE-2021-36028 < 2.3.7-p1, >= 2.4.2-p1, < 2.4.2-p2, = 2.3.7, = 2.4.2 2.3.7-p1, 2.4.2-p2
Show more (20) Showing 60 of 151

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.