CVE-2022-35500

CVE-2022-35500 Magento 2용 Amasty Blog Pro의 댓글 남기기 기능에서 발생하는 저장형 교차 사이트 스크립팅 XSS 설명 Magento 2용 Amasty Blog Pro 2.10.3 및 2.10.4 플러그인의 댓글 남기기 기능은 GraphQL 엔드포인트를 통해 AmBlogLeaveComment 뮤테이션의 name 매개변수에 JavaScript 코드를 주입할 수 있습니다. JavaScript 코드는 피해자관리자가 관리자 패널에서 댓글을 삭제하려고 할 때 실행됩니다. 영향을 받는 버전 2.10.5 권고 ...

Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting. id:...

CVE-2022-36432

CVE-2022-36432 Magento 2 用 Amasty Blog Pro のプレビュー機能におけるクロスサイトスクリプティング XSS 説明 Magento 2 用プラグイン Amasty Blog Pro 2.10.3 のプレビュー機能は、eval を安全でない方法で使用します。これにより、攻撃者は生成されたプレビューアプリケーションの応答を操作して、管理者パネルのユーザーに対してクロスサイトスクリプティング攻撃を行うことができます。 この脆弱性は、blog/view/base/web/js/adminhtml/preview.js ファイルに存在します。...

CVE-2022-35501

CVE-2022-35501 Magento 2용 Amasty Blog Pro의 블로그 게시물 생성 기능에 저장형 크로스사이트 스크립팅XSS 취약점 설명 Magento 2용 Amasty Blog Pro 2.10.3 및 2.10.4 플러그인의 게시물 생성 기능은 title 필드에 JavaScript 코드 삽입을 허용하여, 중복 게시물 기능을 통해 관리자 패널 사용자에 대한 XSS 공격을 유발합니다. 이 기능은 data.title 필드를 사용하여 JavaScript 코드를 실행합니다. 위에서 언급한 매개변수의 주입 지점인 취약한...

CVE-2022-36433

CVE-2022-36433 Amasty Blog Pro for Magento 2의 블로그 게시물 작성 기능에서의 크로스 사이트 스크립팅XSS 설명 Magento 2용 Amasty Blog Pro 2.10.3 플러그인의 블로그 게시물 작성 기능은 shortcontent 및 fullcontent 필드에 JavaScript 코드를 주입할 수 있게 하여, posts/preview 또는 posts/save를 통해 관리자 패널 사용자를 대상으로 한 XSS 공격을 유발합니다. 앞서 언급한 매개변수의 주입 지점이 되는 취약한 엔드포인트:...

amasty-chekout-POC-rce

CVE-2026-53787 - Amasty Order Attributes 未認証ファイルアップロード 説明 CVE-2026-53787 は、Magento 2 向け Amasty Order Attributes 拡張機能のバージョン 4.0.0 未満に存在する、重大な未認証の任意ファイルアップロード脆弱性です。この脆弱性により、攻撃者は認証、セッション検証、カートコンテキストを必要とせずに、任意の種類または名前のファイルをストアのメディアディレクトリにアップロードできます。 影響 この攻撃は認証情報を必要とせず、ネットワーク経由で実行できます。この脆弱性の CVSS スコアは...

CVE-2026-53787

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

CVE-2026-53787 Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

CVE-2026-53787

Amasty Order Attributes for Magento 2 (versions

EUVD-2026-36430

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

PT-2026-48882

Name of the Vulnerable Software and Affected Versions Amasty Order Attributes for Magento 2 versions prior to 4.0.0 Description An unauthenticated arbitrary file upload issue allows attackers to write files of any type or name to the store's media directory. This occurs because the upload endpoin...

CVE-2022-35500

Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting XSS via leave comment functionality...

CVE-2022-35501

Stored Cross-site Scripting XSS exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function...

EUVD-2022-38389

Malicious code in bioql PyPI...

EUVD-2022-39145

Malicious code in bioql PyPI...

EUVD-2022-39144

Malicious code in bioql PyPI...

EUVD-2022-38388

Malicious code in bioql PyPI...

CVE-2022-36433

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...

CVE-2022-36432

The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response...

Amasty Blog Pro for Magento 2 Cross-Site Scripting Vulnerability

Amasty Blog is a website page extension from Amasty. magento2 is an open source PHP e-commerce system. Amasty Blog Pro 2.10.5 before the version for Magento 2 has a cross-site scripting vulnerability , the vulnerability stems from the plugin in the blog post creation function fails to shortconten...