Skip to content
OpenAdvisories

Vendor

aimeos

13 known vulnerabilities.

Products

ai-admin-graphql 3 ai-controller-frontend 2 aimeos-core 2 ai-client-html 2 ai-admin-jsonadm 1 Aimeos Laravel ecommerce platform 1 pagible 1 ai-cms-grapesjs 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.5
    CVE-2024-47173

    Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups

    Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.

    aimeos ai-admin-graphql aimeos/ai-admin-graphql Packagist
  • Medium 5.3
    CVE-2024-39319

    aimeos/ai-controller-frontend has IDOR vulnerability in account profile page

    aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and r…

    aimeos ai-controller-frontend aimeos/ai-controller-frontend Packagist
  • Medium 5.3
    CVE-2024-39325

    aimeos/ai-controller-frontend doesn't reset payment status in basket

    aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchas…

    aimeos ai-controller-frontend aimeos/ai-controller-frontend Packagist
  • Medium 5.5
    CVE-2024-39322

    aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

    aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Ai…

    aimeos ai-admin-jsonadm aimeos/ai-admin-jsonadm Packagist
  • Medium 5.3
    CVE-2024-37296

    Aimeos HTML client vulnerable to digital products download without proper payment status check

    The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without…

    aimeos ai-client-html aimeos/ai-client-html Packagist
  • Medium 5.5
    CVE-2024-37294

    Aimeos denial of service vulnerability in SaaS and marketplace setups

    Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 …

    aimeos aimeos-core aimeos/aimeos-core Packagist