CVE-2022-35698

Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

CVSS 3.1 · 10 Critical EPSS 14.7% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2022-35689

Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2025-24406

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24427

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24421

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24409

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2024-20758

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution on the underlying filesystem. Exploitation of this issue does not require user interaction, but the attack complexity is high.

CVSS 3.1 · 9 Critical EPSS 1.4% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento

CVE-2025-24436

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view select information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24429

Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24432

Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24430

Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2025-24437

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view or modify select information. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Commerce B2b Magento

CVE-2023-22247

Adobe Commerce XML Injection Arbitrary file system read

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2023-22249

Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVSS 3.1 · 4.8 Medium EPSS 58.5% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2023-22250

Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2023-22251

Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Incorrect Authorization vulnerability. A low-privileged authenticated attacker could leverage this vulnerability to achieve minor information disclosure.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento Open Source

CVE-2023-22248

Adobe Commerce Incorrect Authorization Security feature bypass

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak another user's data. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento

CVE-2023-29287

Adobe Commerce Information Exposure Security feature bypass

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Information Exposure vulnerability that could lead to a security feature bypass. An attacker could leverage this vulnerability to leak minor user data. Exploitation of this issue does not require user interaction..

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento

CVE-2023-29288

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user's data. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento

CVE-2023-29289

Adobe Commerce XML Injection Security feature bypass

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with low privileges can trigger a specially crafted script to a security feature bypass. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Commerce Magento