CVE-2025-60991

Codazon Magento Themes (v1.1.0.0–v2.4.7) contains a reflected XSS that allows an attacker to execute arbitrary JavaScript in a user’s browser via a crafted payload in the cat parameter. Root cause described across multiple sources as insufficient input handling/escaping in the cat parameter leadi...

Codazon Magento Themes 安全漏洞

Codazon Magento Themes is a series of Magento platform-specific website themes and templates from Codazon. A security vulnerability exists in Codazon Magento Themes versions v1.1.0.0 through v2.4.7, which stems from insufficient cat parameter cleanup and escaping, and could lead to a reflective...

CVE-2025-58669

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

CVE-2025-58669

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Vinit Lakra in WordPress Plugin Magento 2 WordPress Integration versions = 1.4.2.1...

CVE-2025-58669

CVE-2025-58669 affects Magento 2 WordPress Integration (WordPress plugin) up to version 1.4.1. The issue is a Stored Cross-Site Scripting (XSS) caused by improper input neutralization during web page generation. It is publicly documented as Magento 2 WordPress Integration; vulnerability type is S...

CVE-2025-58669 WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

CVE-2025-58669 WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

PT-2025-38958

Name of the Vulnerable Software and Affected Versions Modern Minds Magento 2 WordPress Integration versions through 1.4.1 Description The Modern Minds Magento 2 WordPress Integration software contains a flaw related to improper input handling during web page generation, specifically a Stored...

Vulnerability fixed in Adobe Commerce and Magento

Adobe has fixed a vulnerability in Adobe Commerce and Magento. The vulnerability is in the way input is validated in Adobe Commerce and Magento. This vulnerability allows attackers to perform session takeover attacks without any user interaction, which can compromise the confidentiality and...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

PT-2025-37037

Adobe released an emergency fix for “SessionReaper,” a critical Adobe Commerce/Magento flaw CVE-2025-542360, CVSS 9.1 enabling session hijacking and potentially unauthenticated RCE. No in-the-wild exploitation reported; patches and guidance are available...

Improper Input Validation

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input,...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation in the authentication process. An attacker can gain unauthorized access to user sessions by submitting crafted input, potentially leading to sessi...

GHSA-WH92-6Q6G-PX7J Magento Community Edition Improper Input Validation vulnerability

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the...

Magento Community Edition Improper Input Validation vulnerability

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the...

APSB25-88 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a critical vulnerability. Successful exploitation could lead to security feature bypass...

PT-2025-36491

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.10 Magento Open Source affected versions not specified Description An improper input validation issue, known as SessionReaper, exists in the REST API, specifically within the ServiceInputProcessor and the...

Improper Input Validation

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Input Validation. An attacker could cause the application to crash or become unresponsive by providing specially crafted input. Remediation Upgrade...

Adobe Commerce Arbitrary Code Execution (APSB24-61)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7.0 2.4.7-p2 Adobe Commerce / 2.4.6.0 2.4.6-p7 Adobe Commerce / 2.4.5.0 2.4.5-p9 Adobe Commerce / 0.x 2.4.4-p10 Adobe Commerce / 2.4.7.0 2.4.7-p2 Magento Open Source / 2.4.6...