Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 68

Export CSV
CVE-2021-36027

Magento Commerce Stored Cross-site Scripting Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36026

Magento Commerce Stored Cross-site Scripting Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36025

Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36024

Magento Commerce Improper Neutralization of Special Elements Used In A Command

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 2.7% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36022

Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

CVSS 3.1 · 9.1 Critical EPSS 3.2% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36020

Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

CVSS 3.1 · 8.2 High EPSS 2.6% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-36012

Magento Commerce Gift Card Business Logic Error

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Adobe
Products
Adobe Commerce Magento Open Source
CVE-2021-21012

Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Adobe
Products
Magento Commerce Magento Open Source