Skip to content
Oroinc vulnerabilities
Newest
-
oroinc oroplatform, orocommerce +1 more
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute...
CVE-2024-50677
Public exploit
6.1 Medium
-
oroinc oroplatform, orocommerce +1 more
OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID
CVE-2023-48296
Fix available
4.3 Medium
-
oroinc oroplatform, platform +1 more
OroPlatform's pinned entity creation form shows pages of other users
CVE-2023-45824
Fix available
4.3 Medium
-
oroinc orocommerce
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
CVE-2023-32065
Fix available
5.8 Medium
-
oroinc orocommerce
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
CVE-2023-32064
Fix available
5.0 Medium
-
churchcrm crm, oroinc client relationship management +1 more
OroCRMCallBundle has incorrect call view page visibility
CVE-2023-32063
Fix available
5.0 Medium
-
oroinc oroplatform, churchcrm crm +1 more
OroCalendarBundle has incorrect system calendar events visibility
CVE-2023-32062
Fix available
5.0 Medium
-
oroinc oroplatform, platform +1 more
OroPlatform vulnerable to path traversal during temporary file manipulations
CVE-2022-41951
Fix available
8.6 High
-
oroinc orocommerce
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
CVE-2022-35950
Fix available
6.9 Medium
-
oroinc orocommerce
OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page
CVE-2022-31037
Fix available
6.9 Medium
-
oroinc oroplatform, platform +1 more
JavaScript Prototype Pollution in oro/platform
CVE-2021-43852
Fix available
8.8 High
-
oroinc oroplatform, platform +1 more
XSS vulnerability in oro/platform
CVE-2021-41236
Fix available
6.9 Medium
-
churchcrm crm, oroinc client relationship management +1 more
The disqualify lead action may be executed without CSRF token check
CVE-2021-39198
Fix available
4.2 Medium