CVE-2025-54236

Adobe Magento SessionReaper LFI PoC A simple Python proof-of-concept demonstrating the CVE-2025-54236 SessionReaper vulnerability affecting vulnerable Adobe Magento versions. Educational and authorized security testing only. Features Automatic target URL normalization Random formkey generation Fi...

day01-sessionreaper-lab

Day 1 — SessionReaper-style Vulnerable Lab Educational This is a tiny lab that simulates the core idea reported for CVE-2025-54236 “SessionReaper”: improper validation of nested JSON leading to dangerous code paths. This is not Magento/Adobe Commerce; it's a minimal educational replica to practic...

Metasploit Wrap-Up 12/12/2025

React2shell Module As you may have heard, on December 3, 2025, the React team announced a critical Remote Code Execution RCE vulnerability in servers using the React Server Components RSC Flight protocol. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0 and is informally...

📄 Magento SessionReaper Remote Code Execution

This Metasploit module exploits CVE-2025-54236 SessionReaper, a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an...

The Grim SessionReaper (CVE-2025-54236) Comes to Collect for Halloween

Akamai researchers report on attack activity of SessionReaper and how to mitigate and defend against it...

Thousands of online stores at risk as SessionReaper attacks spread

Early September, a security researcher uncovered a new vulnerability in Magento, an open-source e-commerce platform used by thousands of online retailers, and its commercial counterpart Adobe Commerce. It sounds like something straight out of a horror movie: SessionReaper. Behind the cinematic na...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

Adobe Commerce Flaw CVE-2025-54236 Lets Hackers Take Over Customer Accounts

Adobe has warned of a critical security flaw in its Commerce and Magento Open Source platforms that, if successfully exploited, could allow attackers to take control of customer accounts. The vulnerability, tracked as CVE-2025-54236 aka SessionReaper, carries a CVSS score of 9.1 out of a maximum ...

PT-2025-37037

Adobe released an emergency fix for “SessionReaper,” a critical Adobe Commerce/Magento flaw CVE-2025-542360, CVSS 9.1 enabling session hijacking and potentially unauthenticated RCE. No in-the-wild exploitation reported; patches and guidance are available...

PT-2025-36491

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.9-alpha2 Adobe Commerce version 2.4.8-p2 Adobe Commerce version 2.4.7-p7 Adobe Commerce version 2.4.6-p12 Adobe Commerce version 2.4.5-p14 Adobe Commerce version 2.4.4-p15 Description Adobe Commerce and...