Skip to content
OpenAdvisories

Package · Packagist

magento/community-edition

360 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-54236 Exploited Public exploit Scanner template EPSS 96%

    Adobe Commerce | Improper Input Validation (CWE-20)

    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality,…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
    KEV Oct 24, 2025
  • Critical 9.8
    CVE-2024-34102 Exploited Public exploit Scanner template EPSS 100%

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability …

    Adobe Adobe Commerce magento/community-edition Packagist
    KEV Jul 17, 2024
  • Critical 10.0
    CVE-2022-35698 Public exploit EPSS 15%

    Adobe Commerce Stored XSS Arbitrary code execution

    Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Critical 9.8
    CVE-2022-24086 Exploited Public exploit Scanner template EPSS 99%

    Adobe Commerce checkout improper input validation leads to remote code execution

    Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code e…

    Adobe Magento Commerce magento/community-edition Web / CMS Packagist
    KEV Feb 15, 2022
  • Critical 9.1
    CVE-2021-21014 Public exploit

    Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console i…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Critical 9.8
    CVE-2019-7139 Public exploit Scanner template EPSS 22%

    Magento 2 Community Edition SQLi Vulnerability

    An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

    Magento Magento Open Source Magento Magento Commerce Web / CMS Packagist