GHSA-W3MQ-67MW-3P9F Magento Cross-Site Request Forgery (CSRF)

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433...

GHSA-X3GH-95P8-43QV MAGMI plugin for Magento Unsafe File Upload

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

MAGMI plugin for Magento Unsafe File Upload

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...

MAGMI cross-site scripting (XSS)

Multiple cross-site scripting XSS vulnerabilities in the MAGMI aka Magento Mass Importer plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php...

GHSA-27V2-398X-F74X MAGMI cross-site scripting (XSS)

Multiple cross-site scripting XSS vulnerabilities in the MAGMI aka Magento Mass Importer plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php...

MAGMI plugin for Magento Server Directory Traversal

Directory traversal vulnerability in web/ajaxpluginconf.php in the MAGMI aka Magento Mass Importer plugin for Magento Server allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

GHSA-C252-XC8V-MQMM MAGMI plugin for Magento Server Directory Traversal

Directory traversal vulnerability in web/ajaxpluginconf.php in the MAGMI aka Magento Mass Importer plugin for Magento Server allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Magento eCommerce CE v2.3.5-p2 - Blind SQLi

Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi Date: 2021-4-21 Exploit Author: Aydin Naserifard Vendor Homepage: https://www.adobe.com/ Software Link: https://github.com/magento/magento2/releases/tag/2.3.5-p2 Version: 2.3.5-p2 Tested on: 2.3.5-p2 POC: 1PUT...

Magento eCommerce CE v2.3.5-p2 - Blind SQL injection Vulnerability

Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi Exploit Author: Aydin Naserifard Vendor Homepage: https://www.adobe.com/ Software Link: https://github.com/magento/magento2/releases/tag/2.3.5-p2 Version: 2.3.5-p2 Tested on: 2.3.5-p2 POC: 1PUT...

Magento eCommerce CE 2.3.5-p2 SQL Injection

Exploit Title: Magento eCommerce CE v2.3.5-p2 - Blind SQLi Date: 2021-4-21 Exploit Author: Aydin Naserifard Vendor Homepage: https://www.adobe.com/ Software Link: https://github.com/magento/magento2/releases/tag/2.3.5-p2 Version: 2.3.5-p2 Tested on: 2.3.5-p2 POC: 1PUT...

magento.mvideo.playlists.top Cross Site Scripting vulnerability OBB-2569755

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

magento.sitemap.socks.bz Cross Site Scripting vulnerability OBB-2545881

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

magento.box.truesocks.net Cross Site Scripting vulnerability OBB-2543494

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for CVE-2022-24087

CVE-2022-24087-RCE and CVE-2022-24086-RCE CVE description...

Adobe Magento Commerce 输入验证错误漏洞

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. An input validation error vulnerability exists in Adobe Commerce formerly known as Magento Commerce and Magento Open Source that stems from insufficient validation of user-supplied input. A remote...

APSB22-13 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a critical vulnerability. Successful exploitation could lead to arbitrary code execution...

PT-2022-6967 · Adobe · Commerce +1

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.3-p1 and earlier Adobe Commerce versions 2.3.7-p2 and earlier Description: The issue is related to an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could...

The vulnerability of the software platform for developing and managing online stores Magento Commerce arises from insufficient validation of input data. This allows attackers to execute arbitrary code.

The vulnerability of the Magento Commerce software platform for developing and managing online stores exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

blog.magento.box.truesocks.net Cross Site Scripting vulnerability OBB-2466602

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Magento Commerce development and management software platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user...