{"id":"CVE-2019-7139","aliases":["EUVD-2022-2395","GHSA-4j6w-9rf8-hg7r"],"status":"published","title":"Magento 2 Community Edition SQLi Vulnerability","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.22242,"percentile":0.97696,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2019-04-10T17:07:20Z","modified":"2026-10-24T10:30:30Z","exploits":[{"source":"nuclei","id":"CVE-2019-7139","title":"Magento - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7139.yaml"},{"source":"pocgithub","id":"0xSemZ/Magento-CVE-2019-7139-SQLi-PoC","title":"0xSemZ/Magento-CVE-2019-7139-SQLi-PoC","date":"2025-07-22","url":"https://github.com/0xSemZ/Magento-CVE-2019-7139-SQLi-PoC"}],"fixes":[{"ecosystem":"Packagist","package":"magento/community-edition","fixed_in":["2.1.18","2.2.9","2.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.18"}]}],"versions":["2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.9"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"]}],"products":[{"vendor":"adobe","product":"magento"},{"vendor":"adobe","product":"magento commerce"},{"vendor":"magento","product":"magento"},{"vendor":"magento","product":"magento commerce"},{"vendor":"magento","product":"magento open source"}],"references":[{"url":"https://www.ambionics.io/blog/magento-sqli","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7139","tags":["advisory"]},{"url":"https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7139.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7139.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7139.yaml","tags":["web"]},{"url":"https://magento.com/security/patches/supee-11086","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4j6w-9rf8-hg7r"},{"url":"https://github.com/magento/magento2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-7139","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-04-10T17:07:20Z","modified":"2024-08-04T20:38:33.547Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2022-2395","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-04-10T17:07:20Z","modified":"2024-08-04T20:38:33Z","updated_at":"2026-11-03T03:06:46.489173Z"}],"ghsa":[{"id":"GHSA-4j6w-9rf8-hg7r","title":"Magento 2 Community Edition SQLi Vulnerability","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2022-05-24T22:00:38Z","modified":"2024-02-12T11:29:53Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:37.394986Z"}],"nvd":[{"id":"CVE-2019-7139","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-04-10T18:29:01.247Z","modified":"2026-06-17T02:40:09.283Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-7139","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-04-10T18:29:01.247Z","modified":"2026-10-24T10:30:30.95733728Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"GHSA-4j6w-9rf8-hg7r","title":"Magento 2 Community Edition SQLi Vulnerability","description":"An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2022-05-24T22:00:38Z","modified":"2024-02-16T08:23:13.097869Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}