Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-79324

Address Deletion Authorization Bypass in Mageplaza GDPR Module

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mageplaza
Products
Gdpr Module-gdpr
CVE-2026-79322

Unauthenticated SQL Injection via /mpblog/post/view in Mageplaza Blog Extension

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mageplaza
Products
Magento 2 Blog Extension Mageplaza Blog
CVE-2026-79323

Magefan Blog GraphQL API Exposes Emails and Internal IDs to Unauthenticated Users

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mageplaza
Products
Magefan Blog