Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

dweeves/magmi

6 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6
Registry
Packagist

Advisories 6

  • Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.

    Affected: through 0.7.24.

  • MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is…

    Affected: fixed in 0.7.24.

  • A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'.

    Affected: fixed in 0.7.24.

  • Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote…

    Affected: fixed in 0.7.22.

  • Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows…

    Affected: through 0.7.21.

  • Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for…

    Affected: through 0.7.17a.