Magneto-PolyShell

Magento 2 RCE 익스플로잇 - 인증되지 않은 파일 업로드를 통한 RCE ⚠️ 이 도구는 교육 및 공인된 보안 테스트 용도로만 제공됩니다. 소유하지 않은 시스템에 대한 무단 사용은 불법입니다. 이 익스플로잇은 Magento 2Adobe Commerce의 치명적인 인증되지 않은 원격 코드 실행RCE 취약점을 대상으로 합니다. GraphQL 제품 조회, 게스트 장바구니 생성, 사용자 정의 제품 옵션을 통한 악성 파일 업로드를 연쇄적으로 활용하여 공격자는 PHP 웹셸을 업로드하고 대상 서버에서 임의의 코드를 실행할 수 있습니다...

cve-2026-71362-magento-lab

CVE-2026-71362 — Magento / Adobe Commerce 顧客セッションのID切替ラボ CVE-2026-71362 をエンドツーエンドで再現し、Adobeの修正を検証できる自己完結型のワンコマンドDockerラボです。 防御担当者、研究者、学生が、使い捨てストア上で実際のアカウント乗っ取りプリミティブを研究できます。 | ---|--- CVE| CVE-2026-71362 製品| Adobe Commerce · Adobe Commerce B2B · Magento Open Source 分類| 不適切な認可（CWE-863） —...

NekoBotV1

NekoBotV1Rev | 自动利用工具，拥有500+利用和2000+ Shell 旧版本：NekobotV1 NekoBotV1Rev 是一款自动利用工具，用于方便渗透一个或多个网站（Wordpress、Joomla、Drupal、Magento、Opencart 等）。 特性： + Wordpress： root@kitploit: 1- Cherry-Plugin 2- download-manager Plugin 3- wysija-newsletters 4- Slider Revolution Revslider 5- gravity-forms 6- userpro 7...

CVE-2021-21014

PoC 제한됨 CVE-2021-21014 Magento 2.4.1및 이전 버전, 2.4.0-p1및 이전 버전, 2.3.6및 이전 버전은 파일 업로드 제한 우회에 취약합니다. 성공적으로 악용하면 인증된 공격자가 임의 코드를 실행할 수 있습니다. 영향을 받는 버전: = Magento 2.4.1 사용자 요구 사항: Media gallery +- Products 권한만 있는 관리자 계정 웹 서버: Apache 2 결과: RCE 참조 https://nvd.nist.gov/vuln/detail/CVE-2021-21014...

magento2-encryption-key-manager-cli

Magento 2 Encryption Key Manager CLI Magento 2の暗号化キーのローテーションと管理のためのユーティリティです。CVE-2024-34102通称 Cosmic Stingの被害者は、アフターケアとして使用できます。 対象 開発での使用 デプロイ自動化 CVE-2024-34102通称 Cosmic Stingのアフターケア CVE-2024-34102通称 Cosmic Sting セキュリティパッチ適用後、攻撃者によるAdminレベルのWebAPIアクセスを完全に拒否するために、キーローテーションを実行する必要があります。...

Exploit for CVE-2026-71362

CVE-2026-71362 — Magento / Adobe Commerce customer-session ide...

APSB26-92 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass, arbitrary code execution, and privilege escalation...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the form fields. An attacker can execute arbitrary JavaScript code in the context of another user's browser session by injecting malicious...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization via the authorization process. An attacker can bypass security measures and gain unauthorized read access by leveraging high privileges without...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization in the authorization process. An attacker can gain unauthorized read and write access by bypassing security measures remotely without user...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the form fields. An attacker can execute arbitrary JavaScript code in the context of another user's browser session by injecting malicious...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization via the authorization process. An attacker can gain unauthorized read and write access by bypassing security measures. Remediation Upgrade...

Open Redirect

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Open Redirect via the redirect process. An attacker can redirect users to an external, attacker-controlled website by crafting a malicious URL and convincing a user to clic...

Improper Encoding or Escaping of Output

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper encoding or escaping of output. An attacker can execute arbitrary code in the context of the current user by crafting...

Arbitrary File Upload

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can execute arbitrary code in the context of the current user by uploading a file with a dangerous type and...

APSB26-73 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass...

CVE-2026-53787

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

CVE-2026-53787

Amasty Order Attributes for Magento 2 (versions

CVE-2026-53787 Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...

EUVD-2026-36430

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without...