Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting. id:...

CVE-2022-36432

CVE-2022-36432 Cross-site Scripting XSS in Preview functionality in Amasty Blog Pro for Magento 2 Description The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading ...

CVE-2022-35500

CVE-2022-35500 Stored Cross-site Scripting XSS in leave comment functionality in Amasty Blog Pro for Magento 2 Description The leave comment functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the AmBlogLeaveComment mutation in name...

amasty-chekout-POC-rce

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File Upload Description CVE-2026-53787 is a critical unauthenticated arbitrary file upload vulnerability in the Amasty Order Attributes extension for Magento 2 versions prior to 4.0.0 . The vulnerability allows attackers to upload files of...

Exploit for CVE-2026-53787

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File...

CVE-2026-53787

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

CVE-2026-53787 Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

CVE-2026-53787

Amasty Order Attributes for Magento 2 (versions

EUVD-2026-36430

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

PT-2026-48882

Name of the Vulnerable Software and Affected Versions Amasty Order Attributes for Magento 2 versions prior to 4.0.0 Description An unauthenticated arbitrary file upload issue allows attackers to write files of any type or name to the store's media directory. This occurs because the upload endpoin...

CVE-2022-35500

Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting XSS via leave comment functionality...

CVE-2022-35501

Stored Cross-site Scripting XSS exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function...

EUVD-2022-39145

Malicious code in bioql PyPI...

EUVD-2022-38389

Malicious code in bioql PyPI...

EUVD-2022-38388

Malicious code in bioql PyPI...

EUVD-2022-39144

Malicious code in bioql PyPI...

CVE-2022-36433

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...

CVE-2022-36432

The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...