EUVD-2026-75137

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 magefan/module-blog-graph-ql through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql...

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in their inadequate authentication procedures, which allow attackers to escalate their privileges.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to enhance their privileges...

CVE-2026-79323

Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql through 2.2.1) contains an information disclosure in the blogComments GraphQL query. A remote unauthenticated attacker can send a POST request to /graphql to obtain blog commenter email addresses and internal customer/admin identifi...

CVE-2026-79322

CVE-2026-79322 is a SQL injection vulnerability in the RelatedProduct block of Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through version 4.3.2 . Remote unauthenticated attackers can execute arbitrary SQL commands and read arbitrary database contents by manipulating the id ...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to exploit this to enhance their privileges.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of protective measures for website structures. Exploiting these vulnerabilities can allow attackers to enhance their...

The vulnerability of software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B lies in the lack of protective measures for website structures, allowing attackers to exploit this to enhance their privileges.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to the lack of protective measures for website structures. Exploiting these vulnerabilities can allow attackers to enhance their...

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B arises from incorrect pathname restrictions in the catalog. This allows attackers to bypass security restrictions.

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to incorrect path name restrictions in the catalog. Exploiting this vulnerability can allow an attacker to bypass security restrictions...

CVE-2026-79324

A missing authorization flaw in the Address Delete controller of the Mageplaza GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 allows a remote, unauthenticated attacker to delete any customer's saved address via a simple GET request to /customer/address/delete/id/{id}. ...

CVE-2022-24086-CVE-2022-24087

CVE-2022-24086-CVE-2022-24087 The blog post that I written about Magento and Adobe Commerce RCE vulnerability CVE-2022-24086&CVE-2022-24087 for Picus Cyber Talent Academy Assignment can be found CVE-2022-24086&CVE-2022-24087.pdf...

magento-upload-auto-submit-zoneh

magento-upload-auto-submit-zoneh CVE-2025-54236 ⚠️ DESCARGO DE RESPONSABILIDAD ⚠️ ¡ADVERTENCIA CRÍTICA! Esta herramienta fue creada exclusivamente para: ✅ Fines educativos e investigación en seguridad ✅ Pruebas de penetración autorizadas ✅ Evaluaciones de seguridad en sistemas de tu propiedad ✅...

cve-2026-75650-magento-validation-lab

CVE-2026-75650 / VULN-39341 Docker validation lab This standalone lab reproduces the StyleSmuggler component-level PHP execution primitive on a revision-pinned Magento Open Source 2.4.9 checkout and then proves that Adobe's VULN-39341 patch blocks the identical input. The proof is non-destructive...

stylesmuggler-adobe-patches

disrex/stylesmuggler-adobe-patches 一个 Composer 插件，可自动将 Adobe 官方 APSB26-146 修复 （CVE-2026-75650，内部 参考 VULN-39341）应用于 Magento Open Source 和 Mage-OS ，用于 StyleSmuggler 零日漏洞， 并自动检测您安装的版本。 它会在安装和更新时自行修补已安装的软件包。它不 依赖 cweagans/composer-patches 或根目录的 enable-patching 标志，因此它不会像 composer-patches v1...

cosmicsting-cve-2024-34102-exploit

CosmicSting CVE-2024-34102 Exploit Suite Complete exploit suite for CVE-2024-34102 - The CosmicSting XXE vulnerability in Adobe Commerce / Magento 2.4.x. Vulnerability Details CVE : CVE-2024-34102 CVSS 9.8 Type : XML External Entity Injection XXE Impact : Unauthenticated remote file read, SSRF,...

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 CVSS score: 10.0, has been codenamed StyleSmuggler by Sansec, which...

Flaws in Adobe Commerce and Magento

Adobe has identified a vulnerability in Adobe Commerce and Magento. The vulnerability lies in the template engine of Adobe Commerce, where certain special elements are not properly neutralized. As a result, an attacker can execute arbitrary code remotely, without requiring user interaction. This...

Exploit for CVE-2026-75650

CVE-2026-75650 / VULN-39341 Docker validation lab This standa...

APSB26-138 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important, and moderate vulnerabilities. Successful exploitation could result in security feature bypass and privilege escalation...