Magento Blind SQL Injection in the Search module

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

GHSA-MP9R-RH95-F8F8 Magento 2 Community Edition RCE Vulnerability

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

eZ Publish Cross-site Scripting (XSS) vulnerability

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

GHSA-M98Q-P5GQ-Q5FF eZ Publish Cross-site Scripting (XSS) vulnerability

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

Out-of-bounds Read

Overview fast-string-search is a module that can search substrings in a string by using N-API and boyer-moore-magiclen. Affected versions of this package are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows...

Search API Pages - Critical - Cross Site Scripting - SA-CONTRIB-2021-046

This module enables you to create simple search pages based on Search API without the use of Views. The module doesn’t sufficiently escape all variables provided for custom templates. This vulnerability is mitigated by the fact that the default template provided by the module is not affected...

Vanguard 2.1 Cross Site Scripting

Document Title: =============== Vanguard v2.1 - Search POST Inject Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2283 Release Date: ============= 2021-10-26 Vulnerability Laboratory ID VL-ID: ==================================== 2283...

Vanguard v2.1 - (Search) POST Inject Web Vulnerability

Document Title: =============== Vanguard v2.1 - Search POST Inject Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2283 Release Date: ============= 2021-10-25 Vulnerability Laboratory ID VL-ID: ==================================== 2283...

CVE-2020-23047

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting XSS vulnerability in the search input field of the search module...

CVE-2020-23047

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting XSS vulnerability in the search input field of the search module...

Cross site scripting

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting XSS vulnerability in the search input field of the search module...

CVE-2020-23047

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting XSS vulnerability in the search input field of the search module...

PT-2021-10823

Name of the Vulnerable Software and Affected Versions Macrob7 Macs Framework Content Management System version 1.14f Description The issue is related to a cross-site scripting XSS vulnerability found in the search input field of the search module. This allows for potential malicious script...

CVE-2020-23047: Improper Neutralization of Input During Web Page Generation

Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting XSS vulnerability in the search input field of the search module...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2021-48498)

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

CVE-2020-36412

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module...

Privilege Escalation

openmage/magento-lts is vulnerable to privilege escalation. An attacker is able to access the admin console through a vulnerability due to an blind SQL injection vulnerability in the Search module...

CVE-2021-21024

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

Sql injection

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

CVE-2021-21024 Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...