BIT-MAGENTO-2021-28567 Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission

Magento versions 2.4.2 and earlier, 2.4.1 and earlier and 2.3.6 and earlier are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful...

BIT-MAGENTO-2021-28583 Magento Commerce insecure storage of sensitive documentation

Magento versions 2.4.2 and earlier, 2.4.1 and earlier and 2.3.6 and earlier are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources...

BIT-MAGENTO-2021-28584 Magento Commerce path traversal vulnerability in child theme store creation

Magento versions 2.4.2 and earlier, 2.4.1 and earlier and 2.3.6 and earlier are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required...

BIT-MAGENTO-2021-28585 Magento Commerce improper input validation in customer customer webapi

Magento versions 2.4.2 and earlier, 2.4.1 and earlier and 2.3.6 and earlier are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails...

BIT-MAGENTO-2021-36021 Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

Magento versions 2.4.2 and earlier, 2.4.2 and earlier and 2.3.7 and earlier are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code...

BIT-MAGENTO-2021-36023 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

BIT-MAGENTO-2021-36036 Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

Magento versions 2.4.2 and earlier, 2.4.2 and earlier and 2.3.7 and earlier are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege...

Magento ver. 2.4.6 - XSLT Server Side Injection Vulnerability

Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection Exploit Author: tmrswrr Vendor Homepage: https://magento2demo.firebearstudio.com/ Software Link: Magento 2.4.6-p3 Version: 2.4.6 Tested on: 2.4.6 POC 1. Enter with admin credentials to this URL: https://magento2demo.firebearstudio.com...

Magento ver. 2.4.6 - XSLT Server Side Injection

Exploit Title: Magento ver. 2.4.6 - XSLT Server Side Injection Date: 2023-11-17 Exploit Author: tmrswrr Vendor Homepage: https://magento2demo.firebearstudio.com/ Software Link: Magento 2.4.6-p3 Version: 2.4.6 Tested on: 2.4.6 POC 1. Enter with admin credentials to this URL:...

Cross-site Scripting (XSS)

Magento LTS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation on form fields within File.php. This allows a low-privileged attacker to inject malicious scripts, resulting in Cross-site Scripting XSS...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores exists due to the failure to take measures to neutralize special elements used in the operating system. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the uncontrolled resource consumption, which allows attackers to cause service failures.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce online stores lies in the ability to forge cross-site requests, allowing attackers to circumvent existing security restrictions.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to the manipulation of cross-site requests. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...

Command Injection

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Command Injection through the command execution interface. An attacker can execute arbitrary commands on the server by injecting malicious inputs into the command parameter...

Command Injection

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Command Injection through the command execution interface. An attacker can execute arbitrary commands on the server by injecting malicious inputs in...

Cross-site Scripting (XSS)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Cross-site Scripting XSS through the admin interface. An attacker with administrative privileges can inject malicious scripts into every admin page,...

Cross-site Request Forgery (CSRF)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the user interaction process. An attacker can bypass security measures and gain unauthorized access by tricking a victim into performing...

Cross-site Request Forgery (CSRF)

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the user interaction process. An attacker can bypass security measures and gain unauthorized access by tricking ...