magento/project-community-edition vulnerabilities (Packagist)
161 vulnerabilities.
magento/project-community-editionPackagistOTP 2FA can be bruteforced7.4 Highmagento/project-community-editionPackagistAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)8.4 Highmagento/project-community-editionPackagistAdobe Commerce | Improper Authorization (CWE-285)4.3 Mediummagento/project-community-editionPackagistUnauthorized user can export Orders Sale Report4.3 Mediummagento/project-community-editionPackagistBeing able to import/export tax rates without proper privileges4.3 Mediummagento/project-community-editionPackagistAdobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)8.4 Highmagento/project-community-editionPackagistA user without Shop Policy Parameters section privilege can alter the shop policy parameters section4.3 Mediummagento/project-community-editionPackagistDOM XSS through integrations can impact other admins8.1 Highmagento/project-community-editionPackagistAn unauthorized user can export the Tax Sales Report4.3 Mediummagento/project-community-editionPackagistAdobe Commerce | Improper Authorization (CWE-285)4.3 Mediummagento/project-community-editionPackagistAdobe Commerce | Improper Input Validation (CWE-20)9.0 Criticalmagento/project-community-editionPackagistAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)8.1 Highmagento/project-community-editionPackagistForce high-usage of resources by generating unlimited coupons: Adobe Commerce4.9 Mediummagento/project-community-editionPackagist[Spain] CSRF to delete Requisition Lists at Adobe Commerce4.3 Mediummagento/project-community-editionPackagist[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-292979.1 Criticalmagento/project-community-editionPackagistCommand injection in data collector backup due to insufficient patching of CVE-2023-382089.1 Criticalmagento/project-community-editionPackagistAdobe Commerce | Uncontrolled Resource Consumption (CWE-400)5.3 Mediummagento/project-community-editionPackagistValidate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping8.7 Highmagento/project-community-editionPackagistFull page cache enumeration via cookie X-Magento-Vary7.5 Highmagento/project-community-editionPackagistError based file extraction via PHP filter chains during product bulk import logic4.9 Mediummagento/project-community-editionPackagistValidate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)6.8 Mediummagento/project-community-editionPackagistIncorrect Authorization - Customer account takeover8.8 Highmagento/project-community-editionPackagistAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)8.0 Highmagento/project-community-editionPackagistAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)8.0 Highmagento/project-community-editionPackagistAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)8.0 Highmagento/project-community-editionPackagistAdobe Commerce post-auth improper input validation leads to remote code execution9.1 Criticalmagento/project-community-editionPackagistMagento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution7.2 Highmagento/project-community-editionPackagistMagento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution7.2 Highmagento/project-community-editionPackagistMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution9.1 Criticalmagento/project-community-editionPackagistAdobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read7.5 Highmagento/project-community-editionPackagistValidate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)9.1 Criticalmagento/project-community-editionPackagistAdobe Commerce Incorrect Authorization Security feature bypass6.5 Mediummagento/project-community-editionPackagistAdmin-to-admin stored XSS via cache poisoning9.1 Criticalmagento/project-community-editionPackagist[Cloud] Customer suspects IDOR vulnerability4.3 Mediummagento/project-community-editionPackagistInsecure Direct Object Reference (IDOR) in Create Quote Function4.3 Mediummagento/project-community-editionPackagistBypass Purchase Order Approval using Company User in Adobe Commerce B2B4.3 Mediummagento/project-community-editionPackagistAdobe Commerce | Improper Input Validation (CWE-20)2.7 Lowmagento/project-community-editionPackagistServer Side Request Forgery (SSRF) in FedEx carrier integration configuration4.9 Mediummagento/project-community-editionPackagistServer Side Request Forgery (SSRF) in USPS carrier integration configuration4.9 Mediummagento/project-community-editionPackagistAdobe Commerce Guest Cart Shipping Address Overwrite IDOR5.3 Mediummagento/project-community-editionPackagistAdobe Commerce XML Injection Security feature bypass6.5 Mediummagento/project-community-editionPackagistAdobe Commerce | Incorrect Authorization (CWE-863)4.3 Mediummagento/project-community-editionPackagistAdobe Commerce Information Exposure Security feature bypass5.3 Mediummagento/project-community-editionPackagistAdobe Commerce Incorrect Authorization Security feature bypass7.5 Highmagento/project-community-editionPackagistAdobe Commerce Incorrect Authorization Security feature bypass4.3 Mediummagento/project-community-editionPackagistAdobe Commerce Improper Access Control Security feature bypass5.3 Mediummagento/project-community-editionPackagistAdobe Commerce XML Injection Arbitrary file system read7.5 Highmagento/project-community-editionPackagistAdobe Commerce Improper Access Control Security feature bypass5.3 Mediummagento/project-community-editionPackagistAdobe Commerce Stored XSS Arbitrary code execution10.0 Criticalmagento/project-community-editionPackagistAdobe Commerce Improper Access Control Security feature bypass5.3 Medium- Show moreLoading…