phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is magento/community-edition vulnerable?

Composer magento/community-edition has 360 known advisories in the phpwarden feed, 3 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.

360advisories
52critical
3on CISA KEV
129no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2024-34102 KEVMagento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerabilitycritical9.8=2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2022-24086 KEVMagento improper input validation vulnerabilitycritical9.8>=2.3.3-p1 and <2.3.7-p3 or >=2.4.0 and <2.4.3-p22.3.7-p3, 2.4.3-p2
CVE-2025-54236 KEVMagento Community Edition Improper Input Validation vulnerabilitycritical9.1<=2.4.5-p14 or =2.4.6 or >=2.4.6-p1 and <=2.4.6-p12 or =2.4.5 or >=2.4.9-alpha1 and <=2.4.9-alpha2 or =2.4.7 or =2.4.8 or >=2.4.7-beta1 and <=2.4.7-p7 or >=2.4.8-beta1 and <=2.4.8-p2 or =2.4.9–
CVE-2021-21029Magento Reflected Cross-site Scripting vulnerability via 'file' parametermedium4.8<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2022-34258Magento stored Cross-Site Scripting (XSS) vulnerabilitymedium5.5>=2.3.0 and <2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2023-22249Magento Open Source allows Cross-Site Scripting (XSS)medium4.8=2.4.4 or =2.4.5 or >=2.4.4-p1 and <=2.4.4-p2 or =2.4.5-p1–
CVE-2019-7139Magento 2 Community Edition SQLi Vulnerabilitycritical9.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2025-24434Improper Authorization vulnerability in Magento and Adobe Commercecritical9.1>=2.4.8-beta1 and <2.4.8-beta2 or >=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p122.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11
CVE-2022-35698Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)critical10.0=2.4.4-p1 or =2.4.4 or =2.4.5 or >=2.4.3-p1 and <=2.4.3-p3 or =2.4.3–
CVE-2020-3716Magento deserialization vulnerabilitycritical9.8>=2.2.0 and <2.2.11 or >=2.3.0 and <2.3.42.2.11, 2.3.4
CVE-2020-3718Magento security bypass vulnerabilitycritical9.8>=2.3.0 and <2.3.4 or <2.2.112.3.4, 2.2.11
CVE-2020-9631Magento security mitigation bypass vulnerabilitycritical9.8>=2.3.0 and <2.3.4-p2 or <=2.2.112.3.4-p2
CVE-2020-9632Magento security mitigation bypass vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2020-9691Magento DOM-based Cross-site scripting vulnerabilitycritical9.6<2.3.5-p22.3.5-p2
CVE-2020-9576Magento command injection vulnerabilitycritical9.8>=2.3.0 and <2.3.4-p2 or <2.2.122.3.4-p2, 2.2.12
CVE-2020-9578Magento command injection vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2020-9582Magento command injection vulnerabilitycritical9.8>=2.3.0 and <2.3.4-p2 or <2.2.122.3.4-p2, 2.2.12
CVE-2020-9583Magento command injection vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2021-21030Magento stored cross-site scripting (XSS) in the customer address upload featurehigh8.1<2.3.6 or >=2.4.0 and <2.4.1-p12.3.6, 2.4.1-p1
CVE-2020-24407Magento 2 Community Edition RCE via Unsafe File Uploadcritical9.1<2.4.12.4.1
CVE-2020-9579Magento Security mitigation bypass vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2020-9580Magento Security mitigation bypass vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2022-34253Magento XML Injection vulnerability in the Widgets Modulecritical9.1<2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2020-9587Magento authorization bypass vulnerabilityhigh7.5<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2020-9585Magento Defense-in-depth security mitigation vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2021-21016Magento OS command injection via the WebAPIcritical9.1<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2021-21014Magento vulnerable to a file upload restriction bypasscritical9.1<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2020-9689Magento path traversal vulnerabilitymedium6.5<2.3.5-p22.3.5-p2
CVE-2021-21018Magento OS Command Injectioncritical9.1<2.3.6 or >=2.4.0 and <2.4.1-p12.3.6, 2.4.1-p1
CVE-2020-9630Magento business logic error vulnerabilitycritical9.8<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2020-9692Magento security mitigation bypass vulnerabilitymedium6.5<2.3.5-p22.3.5-p2
CVE-2024-20720Magento Open Source allows OS Command Injectioncritical9.1=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p4 or >=2.4.5-p1 and <2.4.5-p6 or >=2.4.4-p1 and <2.4.4-p7–
CVE-2021-21019Magento XML injection in the Widgets modulecritical9.1<2.3.6-p1 or >=2.4.0 and <2.4.1-p12.3.6-p1, 2.4.1-p1
CVE-2021-36022Magento XML Injection vulnerability in the Widgets Update Layouthigh7.2<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2020-9591Magento defense-in-depth security mitigation vulnerabilityhigh7.5>=2.3.0 and <2.3.4-p2 or <=2.2.112.3.4-p2
CVE-2021-21025Magento XPath Injectioncritical9.1<2.3.6-p1 or >=2.4.0 and <2.4.1-p12.3.6-p1, 2.4.1-p1
CVE-2019-8159Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2020-3719Magento sql injection vulnerabilityhigh7.5>=2.3.0 and <2.3.4 or <2.2.112.3.4, 2.2.11
CVE-2020-3717Magento Path Traversalmedium5.3>=2.2.0 and <2.2.11 or >=2.3.0 and <2.3.42.2.11, 2.3.4
CVE-2021-36033Magento XML Injection vulnerability in the Widgets Modulecritical0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-36031Magento Path Traversal vulnerability via the `theme[preview_image]` parameterhigh0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-21015Magento OS command injection via the customer attribute save controllerhigh8.0<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2020-9588Magento Signature verification bypasshigh7.2<2.3.4-p22.3.4-p2
CVE-2021-36024Magento is affected by an os command injection via the Data collection endpointhigh7.2<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-36028Magento has an XML Injection vulnerabilitycritical0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-36040Magento has a file extension restrictions bypasscritical9.1=2.4.2 or >=2.4.2-p1 and <2.4.2-p2 or =2.3.7 or <2.3.7-p1–
CVE-2021-36025Magento is affected by an improper input validation vulnerability while saving a customer's detailscritical9.1<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-21024Magento Blind SQL Injection in the Search modulecritical9.1<2.3.6-p1 or >=2.4.0 and <2.4.1-p12.3.6-p1, 2.4.1-p1
CVE-2019-8144Magento 2 Community Edition RCE Vulnerabilitycritical9.8>=2.3 and <2.3.2-p12.3.2-p1
CVE-2021-36020Magento XML Injection vulnerability in the 'City' fieldhigh0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2023-38208Magento Open Source allows Improper Neutralization of Special Elements Usedcritical9.1=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p2 or >=2.4.5-p1 and <2.4.5-p4 or >=2.4.4-p1 and <2.4.4-p5–
CVE-2021-36029Magento improper authorization vulnerabilityhigh7.2<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-36042Magento executes code via the API File Option Upload Extensioncritical9.1=2.4.2 or >=2.4.2-p1 and <2.4.2-p2 or =2.3.7 or <2.3.7-p1–
CVE-2019-8135Remote code execution via vulnerable Symphony dependecy injectioncritical9.8>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-7930Magento 2 Community Unrestricted File Uploadhigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7932Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-21020Magento Improper Access Controlmedium5.3<2.3.6 or >=2.4.0 and <2.4.1-p12.3.6, 2.4.1-p1
CVE-2021-36034Magento affected by remote code execution via a file uploadhigh7.2=2.4.2 or >=2.4.2-p1 and <2.4.2-p2 or =2.3.7 or <2.3.7-p1–
CVE-2021-36041Magento vulnerable to file upload attackhigh7.2<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2019-8141Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2021-36023Magento XML Injection vulnerability in the Widgets Update Layoutcritical9.1<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2020-24401Magento 2 Community Edition Incorrect Authorizationmedium6.5<2.4.12.4.1
CVE-2020-24400Magento SQL Injection vulnerabilityhigh7.1<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2021-36030Magento allows attackers to alter the price of itemshigh0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2022-34255Magento Improper Access Control vulnerabilityhigh8.8>=2.3.0 and <2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2022-34254Magento Path Traversal vulnerabilityhigh8.5>=2.3.0 and <2.3.7-p4 or >=2.4.0 and <2.4.3-p3 or >=2.4.4 and <2.4.52.3.7-p4, 2.4.3-p3, 2.4.5
CVE-2021-36032Magento is affected by an improper input validation vulnerabilityhigh8.8<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-21022Magento Insecure Direct Object Reference (IDOR) in the product modulemedium5.3<2.3.6-p1 or >=2.4.0 and <2.4.1-p12.3.6-p1, 2.4.1-p1
CVE-2019-7950Magento 2 Community Edition Access Control Bypasshigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2022-34256Magento Improper Authorization vulnerabilityhigh7.5>=2.3.0 and <2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2019-8149Magento Broken authentication and session managememtcritical9.8>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-7903Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-36036Magento improper access control vulnerability within Magento's Media Gallery Upload workflowcritical9.1<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2020-24406Magento information disclosure vulnerabilitylow3.7<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2019-7861Magento 2 Community Edition Unsafe File Uploadhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-36012Magento affected by a business logic error in the placeOrder graphql mutationmedium6.5<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-36044Magento affected by a server-side denial-of-service using a GraphQL fieldhigh7.5=2.4.2 or >=2.4.2-p1 and <2.4.2-p2 or =2.3.7 or <2.3.7-p1–
CVE-2021-36021Magento affected by remote code execution vulnerability in the CMS page scheduled update featurecritical9.1<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2019-7876Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7885Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-36043Magento affected by a blind SSRF vulnerability in the bundled dotmailer extensionhigh8.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2019-7895Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7896Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7942Magento 2 Community Edition RCEhigh7.2>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8110Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8111Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8122Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2019-8137Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8150Magento 2 Community Edition RCE Vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2021-28583Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formatshigh7.5>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2019-8154Magento remote code execution vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2020-24404Magento 2 Community Edition vulnerable to Improper Authorizationlow2.7<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2019-8114Magento 2 Community Edition RCE Vulnerabilityhigh7.2<1.9.4.3 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p21.9.4.3, 2.2.10, 2.3.2-p2
CVE-2019-8119Magento 2 Community Edition RCE Vulnerabilityhigh7.2>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2020-9690Magento observable timing discrepancy vulnerabilitymedium4.2<2.3.5-p22.3.5-p2
CVE-2020-3715Magento stored cross-site scripting vulnerabilitymedium6.1>=2.3.0 and <2.3.4 or <2.2.112.3.4, 2.2.11
CVE-2020-3758Magento stored cross-site scripting vulnerabilitymedium6.1>=2.3.0 and <2.3.4 or <2.2.112.3.4, 2.2.11
CVE-2021-21026Magento improper authorization vulnerability in the integrations modulemedium5.3<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2021-36037Magento is affected by an improper authorization vulnerabilitymedium6.5=2.4.2 or >=2.4.2-p1 and <2.4.2-p2 or =2.3.7 or <2.3.7-p1–
CVE-2021-36038Magento discloses sensitive information via the Multishipping Modulemedium6.5<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-28584Magento Path Traversal vulnerabilitymedium5.4>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2019-7892Magento 2 Community Edition RCE Vulnerability via SSRFhigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-36039Magento discloses sensitive informationmedium6.5<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2020-24408Magento 2 Community Edition XSS Vulnerabilitymedium6.1<2.4.12.4.1
CVE-2019-8151Magento Server-Side Request Forgery (SSRF)high7.2>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-8156Magento 2 Community Edition SSRF vulnerabilityhigh7.2>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2020-24402Magento incorrect permissions vulnerability in the Integrations componentmedium4.9<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2021-36026Magento stored cross-site scripting vulnerability in the customer address upload featuremedium0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-21031Magento Insufficient Session Expirationmedium5.6>=2.4.0 and <2.4.1-p1 or <2.3.62.4.1-p1, 2.3.6
CVE-2024-39401Magento OS Command ('OS Command Injection') vulnerabilityhigh8.4>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-39402Magento OS Command ('OS Command Injection') vulnerabilityhigh8.4>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2021-21027Magento cross-site request forgery (CSRF) vulnerability via the GraphQL APImedium4.3<2.3.6-p1 or >=2.4.0 and <2.4.22.3.6-p1, 2.4.2
CVE-2020-24403Magento incorrect user permissions vulnerability within the Inventory componentlow2.7<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2021-39864Magento Open Source allows Cross-Site Request Forgery (CSRF)medium6.5>=2.4.2-p1 and <=2.4.2-p2 or =2.4.3 or <2.3.7-p2 or =2.4.22.3.7-p2
CVE-2022-34259Magento Improper Access Control vulnerabilitymedium5.3>=2.3.0 and <2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2021-21023Magento stored cross-site scripting vulnerability in the admin consolemedium4.8<2.3.6 or >=2.4.0 and <2.4.1-p12.3.6, 2.4.1-p1
CVE-2019-7912Magento Filter extension bypass via crafted store configuration keyshigh7.2>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-28585Magento Improper input validation vulnerabilitymedium5.3>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2021-21032Magento Insufficient Session Expirationmedium5.6>=2.4.0 and <2.4.1-p1 or <2.3.62.4.1-p1, 2.3.6
CVE-2020-24405Magento incorrect permissions vulnerability in the Inventory modulemedium4.3<2.3.6 or >=2.4.0 and <2.4.12.3.6, 2.4.1
CVE-2022-24093Magento Open Source affected by Improper Input Validationhigh7.2=2.4.3 or =2.3.7 or >=2.4.3-p1 and <2.4.3-p2 or >=2.3.7-p1 and <2.3.7-p3–
CVE-2020-9577Magento stored cross-site scripting vulnerabilitymedium6.1<2.3.4-p22.3.4-p2
CVE-2020-9581Magento stored cross-site scripting vulnerabilitymedium6.1<=2.2.11 or >=2.3.0 and <2.3.4-p22.3.4-p2
CVE-2019-8153Magento Cross-site Scripting (XSS)medium6.1>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-7859Magento 2 Community Edition Path Traversal Vulnerabilityhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7911Magento 2 Community Edition Server-Side Request Forgery vulnerabilityhigh7.2>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7913Magento 2 Community Edition SSRF vulnerabilityhigh7.2>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7923Magento 2 Community Edition SSRF vulnerabilityhigh7.2>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2021-28563Magento Unauthorized access to restricted resourcesmedium6.5>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2021-28566Magento Information Disclosure vulnerabilitylow3.7>=2.4.0 and <2.4.2-p1 or >=2.3.0 and <2.3.72.4.2-p1, 2.3.7
CVE-2024-20758Magento Open Source allows Improper Input Validationcritical9.0=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.7-beta1 and <2.4.7 or >=2.4.6-p1 and <2.4.6-p5 or >=2.4.5-p1 and <2.4.5-p7 or >=2.4.4-p1 and <2.4.4-p82.4.7
CVE-2022-35689Magento Open Source allows Improper Access Controlmedium5.3>=2.4.4-p1 and <2.4.4-p2 or =2.4.4 or =2.4.5 or >=2.4.3-p1 and <=2.4.3-p3 or =2.4.3–
CVE-2021-36027Magento stored cross-site scripting vulnerabilitymedium0.0<2.3.7-p1 or =2.3.7 or >=2.4.2-p1 and <2.4.2-p2 or =2.4.2–
CVE-2021-28556Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookiesmedium6.9>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2025-24406Adobe Commerce Path Traversalhigh7.5>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2023-29297Magento Open Source allows Improper Neutralization of Special Elements Usedcritical9.1=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2022-42344Magento Improper input validation vulnerabilityhigh8.8<2.3.7-p4 or >=2.4.0 and <2.4.3-p3 or >=2.4.4 and <2.4.52.3.7-p4, 2.4.3-p3, 2.4.5
CVE-2024-20719Magento Open Source allows Cross-Site Scripting (XSS)critical9.1=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p4 or >=2.4.5-p1 and <2.4.5-p6 or >=2.4.4-p1 and <2.4.4-p7–
CVE-2019-8093Magento Information Disclosure via File upload functionalityhigh8.8>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8158Magento 2 Community Edition XML Injectioncritical9.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2024-34111Magento Open Source Server-Side Request Forgery (SSRF) vulnerabilitymedium6.5=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2019-8127Magento 2 Community Edition SQLi Vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-7871Magento 2 Community Edition Unsafe File Uploadhigh8.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8136Magento 2 Community Edition Insecure Componentcritical9.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8121Using JS libraries with known security vulnerabilitieshigh0.0>=2.2 and <2.2.10 or >=2.3 and <2.3.32.2.10, 2.3.3
CVE-2019-7881Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7860Magento 2 Community Edition Weak PRNGhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7886Magento 2 Community Edition Cryptographic Flawhigh7.5>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7951Magento 2 Community Edition Information Leakhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7915Magento 2 Community Edition DoS vulnerabilityhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7928Magento 2 Community Edition DoS vulnerabilityhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2020-9584Magento Stored cross-site scriptingmedium5.4>=2.3.0 and <2.3.4-p2 or <2.2.122.3.4-p2, 2.2.12
CVE-2019-8108Magento Broken authentication and session managememtmedium6.5>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-7929Magento 2 Community Edition Information Disclosuremedium4.9>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7849Magento 2 Community Edition Session Fixation Checkhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7854Magento 2 Community Edition IDOR Vulnerabilityhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2024-34107Magento Open Source Improper Access Control vulnerabilitymedium5.3=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2023-29291Magento Open Source allows Server-Side Request Forgery (SSRF)medium4.9=2.4.6 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4 or =2.4.5 or =2.4.4–
CVE-2023-38207Magento Open Source allows XML Injectionmedium5.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p2 or >=2.4.5-p1 and <2.4.5-p4 or >=2.4.4-p1 and <2.4.4-p5–
CVE-2019-7939Magento Reflected cross-site scripting on customer cart pagemedium6.1>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2024-20759Magento Open Source allows Cross-Site Scripting (XSS)high8.1=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.7-beta1 and <2.4.7 or >=2.4.6-p1 and <2.4.6-p5 or >=2.4.5-p1 and <2.4.5-p7 or >=2.4.4-p1 and <2.4.4-p82.4.7
CVE-2023-22248Magento Open Source affected by Improper Input Validationhigh7.5=2.4.6 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.5-p4 or =2.4.4 or =2.4.5–
CVE-2023-29293Magento Open Source affected by Improper Input Validationlow2.7=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2019-8130Magento SQL injection vulnerabilityhigh8.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8134Magento SQL injection via marketing account with access to email templates variableshigh8.8>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8133Bypass of sitemp access restrictionsmedium6.5>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2022-34257Magento stored Cross-Site Scripting (XSS) vulnerabilitymedium6.1>=2.3.0 and <2.3.7-p4 or >=2.4.4 and <2.4.5 or >=2.4.0 and <2.4.3-p32.3.7-p4, 2.4.5, 2.4.3-p3
CVE-2023-38209Magento Open Source allows Incorrect Authorizationmedium6.5=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p2 or >=2.4.5-p1 and <2.4.5-p4 or >=2.4.4-p1 and <2.4.4-p5–
CVE-2019-7855Magento 2 Community Cryptographic Flawmedium5.3>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8124Magento 2 Community Edition Insufficient Loggingmedium4.9>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2025-24408Magento Information Exposure vulnerabilitymedium6.5>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2023-22250Magento Open Source allows Improper Access Controlmedium5.3>=2.4.4-p1 and <2.4.4-p3 or =2.4.4 or =2.4.5 or >=2.4.5-p1 and <2.4.5-p2–
CVE-2023-29292Magento Open Source allows Server-Side Request Forgery (SSRF)medium4.9=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2019-7888Magento 2 Community Edition Information Disclosuremedium6.5>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2024-45116Magento Open Source Cross-Site Scripting (XSS) vulnerabilityhigh8.1>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2023-22247Magento Open Source allows XML Injectionhigh7.5>=2.4.5-p1 and <2.4.5-p2 or =2.4.5 or >=2.4.4-p1 and <2.4.4-p3 or =2.4.4–
CVE-2019-7852Magento 2 Community Edition Path Disclosuremedium5.3>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7898Magento 2 Community Edition Information Disclosuremedium5.3>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7899Magento 2 Community Edition Information Disclosuremedium5.3>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8113Magento 2 Community Weak PRNGmedium5.3>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2025-24411Magento Improper Access Control vulnerabilityhigh8.1>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-39399Magento Path Traversal vulnerabilityhigh7.7>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-34103Magento Open Source Improper Authentication vulnerabilityhigh8.1=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2019-8143Magento Injection vulnerability via email templatesmedium6.5>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-7872Magento Insufficient authorization check when adding users to company accountsmedium6.5>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8107Magento 2 Community Edition Arbitrary File Deletionmedium6.5>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2023-38218Magento Open Source allows Incorrect Authorizationhigh8.8>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2024-45119Magento Open Source Server-Side Request Forgery (SSRF) vulnerabilitymedium4.9>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-49555Magento Cross-Site Request Forgery (CSRF) vulnerabilityhigh8.1>=2.4.9-alpha1 and <2.4.9-alpha2 or >=2.4.8-beta1 and <2.4.8-p2 or >=2.4.7-beta1 and <2.4.7-p7 or >=2.4.6-p1 and <2.4.6-p12 or <2.4.5-p14 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.82.4.9-alpha2
CVE-2019-7864Magento 2 Community Edition IDOR Vulnerabilitymedium5.3>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2023-29289Magento Open Source allows XML Injectionmedium6.5=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2019-8126Information disclosure through processing of external XML entitiesmedium4.9>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2024-20716Magento Open Source allows Uncontrolled Resource Consumptionmedium4.9=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p4 or >=2.4.5-p1 and <2.4.5-p6 or >=2.4.4-p1 and <2.4.4-p7–
CVE-2024-39406Magento Open Source Path Traversal vulnerabilitymedium6.8>=2.4.7-p1 and <2.4.7-p2 or =2.4.7 or >=2.4.6-p1 and <2.4.6-p7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p9 or =2.4.5 or <2.4.4-p10 or =2.4.4–
CVE-2023-26366Magento Open Source allows Server-Side Request Forgery (SSRF)medium6.8>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2024-39398Magento does not properly restrict excessive authentication attemptshigh7.4>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2019-8109Magento 2 Community Edition RCE Vulnerability via CSRFhigh8.0>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8232Magento 2 Community Edition RCE Vulnerabilitymedium6.6>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2024-45117Magento Open Source Improper Input Validation vulnerabilityhigh7.6>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2016-6485Unauthenticated crypto and weak IV in Magento\Framework\Encryptionhigh7.5>=2.0 and <2.2.62.2.6
CVE-2019-7877Magento 2 Community Edition XSS Vulnerabilitymedium6.1>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2024-34106Magento Open Source Incorrect Authorization vulnerabilitymedium5.3=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2022-35692Magento Open Source has Improper Access Control vulnerabilitymedium5.3>=2.4.3-p1 and <2.4.3-p3 or >=2.3.7-p1 and <2.3.7-p4 or =2.3.7 or =2.4.4 or =2.4.3–
CVE-2019-7890Magento 2 Community Edition IDOR Vulnerabilityhigh7.3>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2023-38221Magento Open Source allows SQL Injectionhigh8.0>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2023-38249Magento Open Source allows SQL Injectionhigh8.0>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2023-38250Magento Open Source allows SQL Injectionhigh8.0>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2021-28567Magento Improper Authorization vulnerability in the customers modulemedium5.0>=2.4.0 and <2.4.2-p1 or <2.3.72.4.2-p1, 2.3.7
CVE-2019-8123Magento 2 Community Edition Insufficient Loggingmedium5.3>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2019-7889Magento 2 Community Edition Injection Vulnerabilitymedium6.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7904Magento 2 Community Edition Insufficient Access Controlsmedium6.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2023-38220Magento Open Source allows Improper Authorizationhigh7.5>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2023-26367Magento Open Source has Improper Input Validation Vulnerabilitymedium4.9>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2025-24438Magento stored Cross-Site Scripting (XSS) vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-34104Magento Open Source Improper Authorization vulnerabilityhigh8.2=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2019-8090Magento 2 Community Edition Arbitrary File Deletionmedium6.5>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.2.10, 2.3.3
CVE-2025-24424Magento Improper Access Control vulnerabilitymedium6.5>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2019-8140Magento Unrestricted file upload vulnerabilitymedium4.9>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.2.10, 2.3.3
CVE-2024-20718Magento Open Source allows Cross-Site Request Forgery (CSRF)medium4.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p4 or >=2.4.5-p1 and <2.4.5-p6 or >=2.4.4-p1 and <2.4.4-p7–
CVE-2023-38251Magento Open Source allows Uncontrolled Resource Consumptionmedium5.3>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2023-38219Magento Open Source allows Cross-Site Scripting (XSS)high8.7>=2.4.7-beta1 and <2.4.7-beta2 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p3 or >=2.4.5-p1 and <2.4.5-p5 or >=2.4.4-p1 and <2.4.4-p62.4.7-beta2
CVE-2019-8233Composer JavaScript injection possible via html commentsmedium6.1>=2.2 and <2.2.10 or >=2.3 and <2.3.32.2.10, 2.3.3
CVE-2023-29294Magento Open Source has Business Logic Errors Vulnerabilitymedium4.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2019-7858Magento 2 Community Edition Cryptographic Flawhigh7.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7925Magento Insecure Direct Object Reference (IDOR) vulnerabilitymedium4.9>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2025-47110Magneto contains stored XSS vulnerabilitycritical9.1>=2.4.8-beta1 and <2.4.8-p1 or >=2.4.7-beta1 and <2.4.7-p6 or <2.4.5-p13 or =2.4.7 or =2.4.8 or =2.4.5 or >=2.4.6-p1 and <2.4.6-p11 or =2.4.6–
CVE-2024-45132Magento Open Source Improper Authorization vulnerabilitymedium6.5>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2019-8118Magento 2 Community Edition Weak Cryptographymedium5.3>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2023-29287Magento Open Source allows Information Exposuremedium5.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2025-24410Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24412Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24413Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24414Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24415Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24416Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24417Magento Stored Cross-Site Scripting (XSS) Vulnerabilityhigh8.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-39400Magento DOM-based Cross-Site Scripting (XSS) vulnerabilityhigh8.1>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-24409Adobe Commerce Improper Authorization vulnerabilityhigh8.2>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-34105Magento Open Source Cross-Site Scripting (XSS) vulnerabilitymedium4.8=2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or >=2.4.6-p1 and <2.4.6-p6 or >=2.4.5-p1 and <2.4.5-p8 or <2.4.4-p9–
CVE-2025-49559Magento vulnerable to path traversalmedium5.3>=2.4.9-alpha1 and <2.4.9-alpha2 or >=2.4.8-beta1 and <2.4.8-p2 or >=2.4.7-beta1 and <2.4.7-p7 or >=2.4.6-p1 and <2.4.6-p12 or <2.4.5-p14 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.82.4.9-alpha2
CVE-2023-29288Magento Open Source allows Incorrect Authorizationmedium4.3=2.4.6 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4 or =2.4.4 or =2.4.5–
CVE-2023-29295Magento Open Source allows Incorrect Authorizationmedium4.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2023-29296Magento Open Source allows Incorrect Authorizationmedium4.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2024-45118Magento Open Source Improper Access Control vulnerabilitymedium6.5>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-49557Magento Cross-site Scripting vulnerabilityhigh8.7<2.4.4-p15 or >=2.4.5-p1 and <2.4.5-p14 or >=2.4.6-p1 and <2.4.6-p12 or >=2.4.7-p1 and <2.4.7-p7 or =2.4.82.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7
CVE-2025-24425Magento Business Logic Error vulnerabilitymedium5.3>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24427Magento Improper Access Control vulnerabilitymedium6.5>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-45134Magento Open Source Information Exposure vulnerabilitylow2.7>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2023-29290Magento Open Source allows Incorrect Authorizationmedium5.3=2.4.6 or =2.4.5 or =2.4.4 or >=2.4.5-p1 and <2.4.5-p3 or >=2.4.4-p1 and <2.4.4-p4–
CVE-2025-54264Magento vulnerable to stored Cross-Site Scripting (XSS)high8.1>=2.4.9-alpha1 and <2.4.9-alpha3 or >=2.4.8-beta1 and <2.4.8-p3 or >=2.4.7-beta1 and <2.4.7-p8 or <2.4.6-p13 or =2.4.8 or =2.4.7 or =2.4.62.4.9-alpha3
CVE-2024-45124Magento Open Source Improper Access Control vulnerabilitymedium5.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-54263Magento provides incorrect authorization through a security feature bypasshigh8.1>=2.4.9-alpha1 and <2.4.9-alpha3 or >=2.4.8-beta1 and <2.4.8-p3 or >=2.4.7-beta1 and <2.4.7-p8 or <2.4.6-p13 or =2.4.8 or =2.4.7 or =2.4.62.4.9-alpha3
CVE-2024-45133Magento Open Source Information Exposure vulnerabilitylow2.7>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-49556Magento has incorrect authorization issue that leads to arbitrary file system readhigh7.5>=2.4.9-alpha1 and <2.4.9-alpha2 or >=2.4.8-beta1 and <2.4.8-p2 or >=2.4.7-beta1 and <2.4.7-p7 or >=2.4.6-p1 and <2.4.6-p12 or <2.4.5-p14 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.82.4.9-alpha2
CVE-2024-45128Magento Open Source Improper Authorization vulnerabilitymedium5.4>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2019-8157Magento Cross-Site Scripting via admin panelmedium5.4>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8152Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.2.0 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2025-27188Magento Improper Authorization vulnerabilitymedium4.3<2.4.4-p13 or =2.4.4 or =2.4.5 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p12 or >=2.4.6-p1 and <2.4.6-p10 or >=2.4.7-p1 and <2.4.7-p5 or =2.4.7 or >=2.4.8-beta1 and <2.4.82.4.8
CVE-2024-45135Magento Open Source Improper Access Control vulnerabilitylow2.7>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2019-7882Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7921Magento 2 Community Edition Cross-site Scripting Vulnerabilitymedium5.4>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7944Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7945Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2023-22251Magento Open Source allows Incorrect Authorizationmedium4.3>=2.4.4-p1 and <2.4.4-p3 or >=2.4.5-p1 and <2.4.5-p2 or =2.4.5 or =2.4.4–
CVE-2025-49554Magento vulnerable to denial of servicehigh7.5>=2.4.9-alpha1 and <2.4.9-alpha2 or >=2.4.8-beta1 and <2.4.8-p2 or >=2.4.7-beta1 and <2.4.7-p7 or >=2.4.6-p1 and <2.4.6-p12 or <2.4.5-p14 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.82.4.9-alpha2
CVE-2019-8112Magento 2 Community Edition Security Bypasshigh7.5>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-7853Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7862Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7863Magento Stored cross-site scripting in admin panelmedium4.8>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7866Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7867Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7868Magento Cross-site Scripting in the admin panelmedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7869Magento Stored Cross-site Scripting vulnerability in the admin panelmedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7875Magento 2 Community Edition Cross-site Scripting Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7880Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7887Magento 2 Community Edition Cross-site Scripting Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7897Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7908Magento Cross-site Scripting in the admin panelmedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7909Magento 2 Community Edition Cross-site Scripting Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7926Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7927Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7934Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7935Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7936Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.3.0 and <2.3.2 or >=2.2.0 and <2.2.9 or >=2.1.0 and <2.1.182.3.2, 2.2.9, 2.1.18
CVE-2019-7937Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7938Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-8092Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8117Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8120Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.1.0 and <2.1.19 or >=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.32.1.19, 2.2.10, 2.3.3
CVE-2019-8128Magento Cross-Site Scripting via store namemedium5.4>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8129Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Overridemedium5.4>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-8131Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8132Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8138Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8139Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8142Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8145Magento Cross-Site Scripting via Attribute Set Namemedium5.4>=2.2 and <2.2.10 or >=2.3 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8146Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p22.2.10, 2.3.2-p2
CVE-2019-8147Magento 2 Community Edition XSS Vulnerabilitymedium5.4>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8115Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.2.0 and <2.2.10 or >=2.3.0 and <2.3.2-p12.2.10, 2.3.2-p1
CVE-2019-8148Magento 2 Community Edition XSS Vulnerabilitymedium4.8>=2.3.0 and <2.3.2-p22.3.2-p2
CVE-2025-54265Magento allows incorrect authorizationmedium5.9>=2.4.9-alpha1 and <2.4.9-alpha3 or >=2.4.8-beta1 and <2.4.8-p3 or >=2.4.7-beta1 and <2.4.7-p8 or <2.4.6-p13 or =2.4.8 or =2.4.7 or =2.4.62.4.9-alpha3
CVE-2024-45122Magento Open Source Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-24421Magento Incorrect Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.8-beta12.4.4-p12
CVE-2025-24436Magento Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-27190Magento Improper Access Control leads to Security feature bypassmedium5.3>=2.4.7-beta1 and <2.4.7-p5 or >=2.4.6-p1 and <2.4.6-p10 or >=2.4.5-p1 and <2.4.5-p12 or <2.4.4-p13 or >=2.4.8-beta1 and <2.4.8-beta2 or =2.4.5 or =2.4.4 or =2.4.6 or =2.4.72.4.8-beta2
CVE-2024-39403Magento Stored Cross-Site Scripting (XSS) vulnerabilityhigh7.6>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-43585Magento Improper Authorization leading to security feature bypasshigh8.2>=2.4.7-beta1 and <2.4.7-p6 or >=2.4.6-p1 and <2.4.6-p11 or <2.4.5-p13 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.8–
CVE-2024-45121Magento Open Source Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45125Magento Open Source Incorrect Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45129Magento Open Source Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45130Magento Open Source Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-24435Magento Improper Access Control vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or <2.4.4-p12 or =2.4.7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p11 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24429Magento Improper Access Control vulnerabilitylow3.5>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2019-7865Magento 2 Community Edition CSRF Vulnerabilityhigh8.8>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2025-27191Magento Improper Access Control leads to Security feature bypassmedium5.3>=2.4.7-beta1 and <2.4.7-p5 or >=2.4.6-p1 and <2.4.6-p10 or >=2.4.5-p1 and <2.4.5-p12 or <2.4.4-p13 or >=2.4.8-beta1 and <2.4.8-beta2 or =2.4.5 or =2.4.4 or =2.4.6 or =2.4.72.4.8-beta2
CVE-2024-45127Magento Open Source stored Cross-Site Scripting (XSS) vulnerabilitymedium4.8>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-39408Magento Open Source Cross-Site Request Forgery vulnerabilitymedium4.3>=2.4.7-p1 and <2.4.7-p2 or =2.4.7 or >=2.4.6-p1 and <2.4.6-p7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p9 or =2.4.5 or <2.4.4-p10 or =2.4.4–
CVE-2024-39409Magento Open Source Cross-Site Request Forgery (CSRF) vulnerabilitymedium4.3>=2.4.7-p1 and <2.4.7-p2 or =2.4.7 or >=2.4.6-p1 and <2.4.6-p7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p9 or =2.4.5 or <2.4.4-p10 or =2.4.4–
CVE-2024-39410Magento Open Source Cross-Site Request Forgery (CSRF) vulnerabilitymedium4.3>=2.4.7-p1 and <2.4.7-p2 or =2.4.7 or >=2.4.6-p1 and <2.4.6-p7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p9 or =2.4.5 or <2.4.4-p10 or =2.4.4–
CVE-2025-27192Magento does not properly protect credentialslow2.7>=2.4.7-beta1 and <2.4.7-p5 or >=2.4.6-p1 and <2.4.6-p10 or >=2.4.5-p1 and <2.4.5-p12 or <2.4.4-p13 or >=2.4.8-beta1 and <2.4.8-beta2 or =2.4.5 or =2.4.4 or =2.4.6 or =2.4.72.4.8-beta2
CVE-2024-45123Magento Open Source reflected Cross-Site Scripting (XSS) vulnerabilitymedium6.1>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45149Magento Open Source Improper Access Control vulnerabilitylow2.7>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-27206Magento Improper Access Control leads to security feature bypassmedium5.3>=2.4.7-beta1 and <2.4.7-p6 or >=2.4.6-p1 and <2.4.6-p11 or <2.4.5-p13 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.8–
CVE-2024-39404Magento Improper Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45131Magento Open Source Improper Authorization vulnerabilitymedium5.4>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-24437Magento Improper Access Control vulnerabilitymedium5.4>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-39411Magento Improper Authorization leads to security feature bypassmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2024-39413Magento Improper Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-39414Magento Improper Access Control Leads to Privilege escalationmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2024-39415Magento Improper Authorization Leading to Security feature bypassmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2024-39417Magento Improper Authorization leads to Security feature bypassmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2019-7851Magento 2 Community Edition CSRF vulnerabilitymedium6.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7874Magento 2 Community Edition XSS Vulnerabilitymedium6.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2019-7947Magento 2 Community Edition CSRF vulnerabilitymedium6.5>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2018-5301Magento Cross-Site Request Forgery (CSRF)medium6.5<2.0.10 or >=2.1.0 and <2.1.22.0.10, 2.1.2
CVE-2025-54267Magento vulnerable to privilege escalation due to incorrect authorizationmedium6.5>=2.4.9-alpha1 and <2.4.9-alpha3 or >=2.4.8-beta1 and <2.4.8-p3 or >=2.4.7-beta1 and <2.4.7-p8 or <2.4.6-p13 or =2.4.8 or =2.4.7 or =2.4.62.4.9-alpha3
CVE-2024-39405Magento Improper Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-39407Magento Improper Authorization vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-39412Magento Open Source Improper Authorization vulnerabilitymedium4.3>=2.4.7-p1 and <2.4.7-p2 or =2.4.7 or >=2.4.6-p1 and <2.4.6-p7 or =2.4.6 or >=2.4.5-p1 and <2.4.5-p9 or =2.4.5 or <2.4.4-p10 or =2.4.4–
CVE-2024-39419Magento Improper Access Control Leads to Privilege escalationmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2024-39416Magento Improper Authorization leads to Security feature bypassmedium4.3>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or <2.4.4-p10 or =2.4.4 or =2.4.5 or =2.4.6 or =2.4.7–
CVE-2025-24428Magento stored Cross-Site Scripting (XSS) vulnerabilitymedium5.4>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2024-39418Magento Improper Authorization vulnerabilitymedium5.4>=2.4.7-beta1 and <2.4.7-p2 or >=2.4.6-p1 and <2.4.6-p7 or >=2.4.5-p1 and <2.4.5-p9 or >=2.4.4-p1 and <2.4.4-p10 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2024-45120Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilitymedium4.3>=2.4.7-beta1 and <2.4.7-p3 or >=2.4.6-p1 and <2.4.6-p8 or >=2.4.5-p1 and <2.4.5-p10 or <2.4.4-p11 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4–
CVE-2025-49558Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilitymedium5.9>=2.4.9-alpha1 and <2.4.9-alpha2 or >=2.4.8-beta1 and <2.4.8-p2 or >=2.4.7-beta1 and <2.4.7-p7 or >=2.4.6-p1 and <2.4.6-p12 or <2.4.5-p14 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.82.4.9-alpha2
CVE-2025-24430Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilitylow3.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-24432Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilitylow3.7>=2.4.7-beta1 and <2.4.7-p4 or >=2.4.6-p1 and <2.4.6-p9 or >=2.4.5-p1 and <2.4.5-p11 or <2.4.4-p12 or =2.4.7 or =2.4.6 or =2.4.5 or =2.4.4 or =2.4.8-beta1–
CVE-2025-49549Magento Authenticated Security feature bypasslow2.7>=2.4.7-beta1 and <2.4.7-p6 or >=2.4.6-p1 and <2.4.6-p11 or <2.4.5-p13 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.8–
CVE-2019-7857Magento Cross-Site Request Forgery (CSRF)medium4.3>=2.2.0 and <2.2.9 or >=2.1.0 and <2.1.18 or >=2.3.0 and <2.3.22.2.9, 2.1.18, 2.3.2
CVE-2019-7873Magento 2 Community Edition Cross-site Scripting Vulnerabilitymedium4.3>=2.1.0 and <2.1.18 or >=2.2.0 and <2.2.9 or >=2.3.0 and <2.3.22.1.18, 2.2.9, 2.3.2
CVE-2025-49550Magento Security feature bypassmedium4.3>=2.4.7-beta1 and <2.4.7-p6 or >=2.4.6-p1 and <2.4.6-p11 or <2.4.5-p13 or =2.4.5 or =2.4.6 or =2.4.7 or =2.4.8–
CVE-2025-54266Magento vulnerable to stored Cross-Site Scripting (XSS)medium4.8>=2.4.9-alpha1 and <2.4.9-alpha3 or >=2.4.8-beta1 and <2.4.8-p3 or >=2.4.7-beta1 and <2.4.7-p8 or <2.4.6-p13 or =2.4.8 or =2.4.7 or =2.4.62.4.9-alpha3
GHSA-26hq-7286-mg8fMagento Patch SUPEE-9652 - Remote Code Execution using mail vulnerabilitycritical0.0>=1.9.0.0 and <1.14.3.21.14.3.2
GHSA-5gmh-85x8-5cx7Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilitiescritical0.0>=2.1 and <2.1.14 or >=2.2 and <2.2.52.1.14, 2.2.5
GHSA-6wm4-3rjj-c8xxMagento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilitiescritical0.0>=1.5.0.0 and <1.9.4.01.9.4.0
GHSA-8j7c-682x-r9f2Magento RCE,XSS and other vulnerabilitiescritical0.0>=2.1 and <2.1.16 or >=2.2 and <2.2.72.1.16, 2.2.7
GHSA-cv25-3pxr-4q7xMagento Open Source Security Advisory: Patch SUPEE-10975critical0.0>=1.9.0.0 and <1.14.4.01.14.4.0
GHSA-mcfc-67vm-j568Magento Cross-Site Scripting (XSS) vulnerabilitymedium0.0>=2.1 and <2.1.15 or >=2.2 and <2.2.62.1.15, 2.2.6
GHSA-prpf-cj87-hwvrMagento Patch SUPEE-10752 - Multiple security enhancements vulnerabilitiescritical0.0<1.9.3.91.9.3.9

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.