High WID-SEC-2025-2295 5 CVEs

Adobe Magento: Mehrere Schwachstellen

Published Oct 14, 2025 · Updated Oct 14, 2025 · de-DE

Vendor: Adobe Product: Magento Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Adobe Magento ausnutzen, um Sicherheitsvorkehrungen zu umgehen, privilegien zu eskalieren und code auszuführen.

Product

Magento ist ein Online-Shop System von Adobe.

Vulnerabilities 5

High 8.1

CVE-2025-54263

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and maintai…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Oct 14, 2025
High 8.1

CVE-2025-54264

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject mal…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Oct 14, 2025
Medium 6.5

CVE-2025-54267

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain un…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Oct 14, 2025
Medium 5.9

CVE-2025-54265

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized rea…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Oct 14, 2025
Medium 4.8

CVE-2025-54266

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnera…

Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist

Oct 14, 2025

Revision history

2025-10-14 #1
Initiale Fassung

References

Adobe Product Security Bulletin APSB25-94 vom 2025-10-14
https://helpx.adobe.com/security/products/magento/apsb25-94.html