Magento-APSB22-48-Security-Patches

Official Magento Patches have been released:Magento Docs These patches address the same security issues as this repository does. Except that we've added a few fixes to older Magento versions. Security patches for APSB22-48 This repository contains Magento 2 Patch Files for the recently found...

CVE-2011-2461_Magento_Patch

CVE-2011-2461MagentoPatch By Edmonds Commerce This CVE relates to a CSRF vulnerability in the Adobe Flex .swf files used by Magento. You can find more information regarding the CVE here: Peter O'Callaghan - Magento CSRF vulnerability via Adobe Flex Minded Security - The old is new, again...

PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-

CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Description CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve...

stylesmuggler

StyleSmuggler HTTP PoC Private research repository for the HTTP-only reproduction of StyleSmuggler, CVE-2026-75650, against a local Magento Open Source lab. Read the full technical walkthrough in Magento StyleSmuggler RCE: Report Poisoning to Code Execution. The Python PoC performs the complete...

magento2-encryption-key-manager-cli

Magento 2 Encryption Key Manager CLI A utility for Magento 2 encryption key rotation and management. CVE-2024-34102aka Cosmic Sting victims can use it as an aftercare. Designed for Development usage Deployment automation CVE-2024-34102aka Cosmic Sting aftercare CVE-2024-34102aka Cosmic Sting Afte...

Magento-CVE-2016-4010

Analysis and Exploitation of Magento Unauthenticated Remote Code Execution Vulnerability CVE-2016-4010 0x00 Preface On May 17, foreign security researcher Netanel Rubin publicly disclosed an unauthenticated remote code execution vulnerability in Magento CVE-2016-4010. This vulnerability actually...

CVE-2021-21014

PoC Limited CVE-2021-21014 Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Affected version: = Magento 2.4.1 User...

CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102 : Unauthenticated Magento XXE and bypassing WAF , You will get http connection on ur webhook POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2 Host: example.com Accept: application/json, text/javascript, /; q=0.01 Content-Length: 310 Content-Type:...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento

CosmicSting: critical unauthenticated XXE vulnerability in Adobe Commerce and Magento CVE-2024-34102 CVE-2024-34102 is a severe security flaw arising from improper handling of nested deserialization in Adobe Commerce and Magento. This vulnerability permits attackers to exploit XML External Entiti...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

cosmicsting-validator

A Cosmicsting POC, with a bash script to check all of our hosted sites to confirm the patch. This repository is provided to allow store owners / hosts to confirm the patch is applied on stores. Within check.bash add domains to the SITES list. https://www.sdj.pw/posts/magento2-cosmic-sting-check/...

CVE-2024-34102

CVE-2024-34102: Unauthenticated Magento XXE CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-34102 with Asychronous Performance. Installation git clone https://github.com/th3gokul/CVE-2024-34102.git cd CVE-2024-34102 pip install -r requirements.txt python3 cvehunter.p...

CVE-2022-36432

CVE-2022-36432 Cross-site Scripting XSS in Preview functionality in Amasty Blog Pro for Magento 2 Description The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by...

CVE-2015-1397

POC for CVE-2015-1397 Magento SQL Injection. Read more at : https://blog.checkpoint.com/security/analyzing-magento-vulnerability/...

CVE-2022-36433

CVE-2022-36433 Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading ...

magento-upload-auto-submit-zoneh

magento-upload-auto-submit-zoneh CVE-2025-54236 ⚠️ DISCLAIMER ⚠️ CRITICAL WARNING! This tool was created exclusively for: ✅ Educational purposes and security research ✅ Authorized penetration testing ✅ Security assessments on systems you own ✅ Vulnerability verification with written permission...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

cosmicsting-cve-2024-34102-exploit

CosmicSting CVE-2024-34102 Exploit Suite Complete exploit suite for CVE-2024-34102 - The CosmicSting XXE vulnerability in Adobe Commerce / Magento 2.4.x. Vulnerability Details CVE : CVE-2024-34102 CVSS 9.8 Type : XML External Entity Injection XXE Impact : Unauthenticated remote file read, SSRF,...

LetMeFuckIt-Scanner

LetMeFuckIt Scanner AutoPWNED Scanner and Exploit Magento The Scanner explores the SQLi Vulnerability 1.9.1.0 CE of Magento. The vulnerability was fixed in Patch SUPEE-5344 , however, the scanner is used to locate and test systems that did not apply the security patch. LetMeFuckIt was written in...