Composer magento/product-community-edition has 133 known advisories in the phpwarden feed, 1 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-34102 KEV | Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnerability | unknown | 0.0 | <2.4.4 or >=2.4.4 and <2.4.4-p9 or >=2.4.5 and <2.4.5-p8 or >=2.4.6 and <2.4.6-p6 or >=2.4.7 and <2.4.7-p1 | 2.4.4, 2.4.4-p9, 2.4.5-p8, 2.4.6-p6 |
| CVE-2019-7139 | PRODSECBUG-2198: SQL Injection due to a flaw in MySQL adapter | unknown | 0.0 | >=2.1 and <2.1.18 | 2.1.18 |
| CVE-2019-7850 | PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8159 | PRODSECBUG-2223: Remote code execution when using functionality that imports a new product | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7846 | PRODSECBUG-1513: Insufficient brute force protections on promo code entry | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8144 | PRODSECBUG-2403: Remote code execution through crafted PageBuilder templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8135 | PRODSECBUG-2417: Remote code execution via vulnerable Symphony dependecy injection | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7930 | PRODSECBUG-2349: Arbitrary code execution via file upload in admin import feature | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7932 | PRODSECBUG-2351: Arbitrary code execution via crafted sitemap creation | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8141 | PRODSECBUG-2407: Remote code execution due to unsafe PHP archieve deserialization in the import functionality | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7950 | PRODSECBUG-2429: Insecure object reference via customer REST API | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8149 | PRODSECBUG-2390: Broken authentication and session managememt | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7903 | PRODSECBUG-2306: Remote code execution through crafted email templates | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7861 | PRODSECBUG-2177: Insufficient server side validations leads to Insecure File upload vulnerability | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7876 | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7885 | PRODSECBUG-2266: Arbitrary code execution through malicious elastic search module configuration | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8116 | PRODSECBUG-2456: Broken authentication and session managememt | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7895 | PRODSECBUG-2296: Arbitrary code execution through design layout update | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7896 | PRODSECBUG-2298: Arbitrary code execution through product imports and design layout update | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7942 | PRODSECBUG-2375: Arbitrary code execution via malicious XML layouts | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8110 | PRODSECBUG-2470: Remote Code Execution in email templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8111 | PRODSECBUG-2469: Remote Code Execution in email templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8122 | PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8137 | PRODSECBUG-2414: Remote code execution through custom layout update of the content management functionality | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8150 | PRODSECBUG-2376: Remote code execution through crafted page layout and image data | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8154 | PRODSECBUG-2332: Remote code execution through arbitrary file inclusion | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8114 | PRODSECBUG-2462: Remote code execution via file upload in admin import feature | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8119 | PRODSECBUG-2449: Remote code execution via local file delete and XSLT injection | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7892 | PRODSECBUG-2285: Arbitrary code execution due to unsafe handling of a carrier gateway | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8151 | PRODSECBUG-2367: Remote code execution due to unsafe handling of a carrier gateway | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8156 | PRODSECBUG-2309: Server-side request forgery via crafted connector endpoint | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7912 | PRODSECBUG-2321: Filter extension bypass via crafted store configuration keys | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8153 | PRODSECBUG-2342: Cross-Site Scripting mitigation bypass | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7859 | PRODSECBUG-2173: Path traversal vulnerability in WYSIWYG editor. | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7911 | PRODSECBUG-2320: Arbitrary code execution due to unsafe handling of system configuration | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7913 | PRODSECBUG-2322: Arbitrary code execution due to unsafe handling of a shipping gateway | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7923 | PRODSECBUG-2339: Arbitrary code execution due to unsafe handling of a carrier gateway | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8093 | PRODSECBUG-2485: Information Disclosure via File upload functionality | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8158 | PRODSECBUG-2272: XPath Injection via front end rendering functionality | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8127 | PRODSECBUG-2434: SQL injection in 'Catalog Products List' widget leading to privilege escalation | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7871 | PRODSECBUG-2202: Security bypass via form data injection | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8121 | Using JS libraries with known security vulnerabilities | high | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8136 | PRODSECBUG-2416: Using vulnerable component that provides abstraction of HTTP specification | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7881 | PRODSECBUG-2245: Stored cross-site scripting in store shipping methods configuration | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7860 | PRODSECBUG-2174: Use of insufficiently random values in multiple security relevant contexts | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7886 | PRODSECBUG-2267: Use of insufficiently random values when generating initialization vector | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7951 | PRODSECBUG-2430: Security bypass via crafted SOAP requests | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7915 | PRODSECBUG-2325: Denial-of-service by forcing a store to respond with a 404 error | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7928 | PRODSECBUG-2347: Insufficient brute-forcing defenses in the token exchange protocol could be abused in carding attacks | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8108 | PRODSECBUG-2478: Broken authentication and session managememt | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7929 | PRODSECBUG-2348: Sensitive data disclosure via crafted two factor edit user form | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7849 | PRODSECBUG-2095: Defense-in-depth session validation check implemented | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7854 | PRODSECBUG-2132: Insecure Direct Object Reference (IDOR) vulnerability can expose sensitive company details | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7939 | PRODSECBUG-2370: Reflected cross-site scripting on customer cart page | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8130 | PRODSECBUG-2424: SQL injection when accessing group data in email templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8134 | PRODSECBUG-2418: SQL injection via marketing account with access to email templates variables | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8133 | PRODSECBUG-2419: Bypass of sitemp access restrictions | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7855 | PRODSECBUG-2164: Use of cryptographically weak PRNG to create gift card codes | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8124 | PRODSECBUG-2444: Missing logs of configuration changes related to design update | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7888 | PRODSECBUG-2273: Sensitive data disclosure though malicious email templates | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7852 | PRODSECBUG-2127: Disclosure of Magento admin panel URL | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7898 | PRODSECBUG-2300: Information about disabled products can be leaked due to inadequate validation checks | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7899 | PRODSECBUG-2301: Names of disabled products can be leaked due to inadequate validation checks | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8113 | PRODSECBUG-2464: Use of weak cryptographic function | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8143 | PRODSECBUG-2405: Injection vulnerability via email templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7872 | PRODSECBUG-2208: Insufficient authorization check when adding users to company accounts | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8107 | PRODSECBUG-2484: Arbitrary file deletion through export data data transfer | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7864 | PRODSECBUG-2186: Insecure Direct Object Reference (IDOR) vulnerability can expose order details | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8126 | PRODSECBUG-2440: Information disclosure through processing of external XML entities | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8109 | PRODSECBUG-2475: Remote Code Execution through Cross-Site Request Forgery (CSRF) | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2016-6485 | Unauthenticated crypto and weak IV in Magento\Framework\Encryption | unknown | 0.0 | >=2.0 and <2.1 or >=2.1 and <2.2 or >=2.2 and <2.2.6 | 2.2.6 |
| CVE-2019-7877 | PRODSECBUG-2233: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7890 | PRODSECBUG-2276: Insecure Direct Object Reference (IDOR) vulnerability can expose order shipping details | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8123 | PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7889 | PRODSECBUG-2275: Unsafe functionality is exposed via email templates manipulation | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7904 | PRODSECBUG-2307: Insufficient enforcement of user access controls can lead to unauthorized environment configuration changes | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8090 | PRODSECBUG-2494: Arbitrary file deletion through design layout update | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8140 | PRODSECBUG-2408: Unrestricted upload of file with dangerous type | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7858 | PRODSECBUG-2172: Insecure user credential storage | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7925 | PRODSECBUG-2343: Insecure Direct Object Reference (IDOR) vulnerability can lead to deletion of downloadable products folder | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8118 | PRODSECBUG-2452: User Password is stored in clear | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8152 | PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8157 | PRODSECBUG-2290: Cross-Site Scripting via admin panel | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7882 | PRODSECBUG-2246: Stored cross-site scripting in the WYSIWYG editor | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7921 | PRODSECBUG-2337: Stored cross-site scripting in the catalog templates form | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7944 | PRODSECBUG-2378: Stored cross-site scripting in the Return Product comments feature | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7945 | PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8112 | PRODSECBUG-2465: Bypass of user confirmation mechanism | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7938 | Magento 2 Community Edition XSS Vulnerability | medium | 4.8 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7853 | PRODSECBUG-2128: Stored Cross Site Scripting in the Admin Panel through the tax/notification/info_url setting | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7862 | PRODSECBUG-2182: Reflected cross-site scripting in the admin panel. | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7863 | PRODSECBUG-2183: Stored cross-site scripting in admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7866 | PRODSECBUG-2188: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7867 | PRODSECBUG-2190: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7868 | PRODSECBUG-2193: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7869 | PRODSECBUG-2194: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7875 | PRODSECBUG-2226: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7880 | PRODSECBUG-2244: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7887 | PRODSECBUG-2270: Reflected cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7897 | PRODSECBUG-2299: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7908 | PRODSECBUG-2316: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7909 | PRODSECBUG-2317: Stored cross-site scripting in admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7926 | PRODSECBUG-2345: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7927 | PRODSECBUG-2346: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7934 | PRODSECBUG-2353: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7935 | PRODSECBUG-2363: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7936 | PRODSECBUG-2364: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7937 | PRODSECBUG-2366: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7940 | PRODSECBUG-2371: Stored cross-site scripting in the admin panel | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-8092 | PRODSECBUG-2489: Cross side scripting during the preview of email templates | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8117 | PRODSECBUG-2455: Stored cross-site scripting (XSS) from URL in to product page | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8120 | PRODSECBUG-2448: Cross side scripting via admin panel dashboard | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8128 | PRODSECBUG-2426: Cross-Site Scripting via store name | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8129 | PRODSECBUG-2425: Cross-Site Scripting via Signifyd Guarantee Option Translation Override | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8131 | PRODSECBUG-2423: Cross-Site Scripting via inventory source | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8132 | PRODSECBUG-2422: Cross-Site Scripting via Email Template Name | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8138 | PRODSECBUG-2412: Cross-Site Scripting via Location Name | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8139 | PRODSECBUG-2410: Cross-Site Scripting via Dynamic block in the Page builder | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8142 | PRODSECBUG-2406: Cross-Site Scripting via Payment Method Title | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8145 | PRODSECBUG-2402: Cross-Site Scripting via Attribute Set Name | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8146 | PRODSECBUG-2401: Cross-Site Scripting via Customer Attribute Option Value | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8147 | PRODSECBUG-2398: Cross-Site Scripting via Customer Attribute Labels | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8115 | PRODSECBUG-2458: Cross-Site Scripting in image file names | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-8148 | PRODSECBUG-2392: Cross-Site Scripting via PageBuilder Banner | unknown | 0.0 | >=2.2 and <2.2.10 or >=2.3 and <2.3.2-p2 | 2.2.10, 2.3.2-p2 |
| CVE-2019-7865 | Magento 2 Community Edition CSRF Vulnerability | high | 8.8 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7851 | PRODSECBUG-2125: Deletion of Blocks via cross-site request forgery (CSRF) | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7874 | PRODSECBUG-2222: Deletion of user roles via cross-site request forgery (CSRF) | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7947 | PRODSECBUG-2387: Cross site request forgery attacks are possible via the gift card removal feature | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7857 | PRODSECBUG-2171: Insecure token implementation leads to Cross-Site Request Forgery (CSRF) | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7873 | PRODSECBUG-2220: Deletion of store design schedule via cross-site request forgery (CSRF) | unknown | 0.0 | >=2.1 and <2.1.18 or >=2.2 and <2.2.9 or >=2.3 and <2.3.2 | 2.1.18, 2.2.9, 2.3.2 |
| 2018-06-27 | Magento 2.2.5 and 2.1.14 Security update | unknown | 0.0 | >=2.1 and <2.1.14 or >=2.2 and <2.2.5 | 2.1.14, 2.2.5 |
| 2018-09-10 | Magento 2.2.6 and 2.1.15 Security update | unknown | 0.0 | >=2.1 and <2.1.15 or >=2.2 and <2.2.6 | 2.1.15, 2.2.6 |
| 2018-11-28 | Magento 2.2.7 and 2.1.16 Security update. Closes RCE,XSS and other vulnerabilities | unknown | 0.0 | >=2.1 and <2.1.16 or >=2.2 and <2.2.7 | 2.1.16, 2.2.7 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked