# magento/project-community-edition (Packagist) vulnerabilities

161 known vulnerabilities (24 critical, 44 high, 68 medium, 7 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/magento/project-community-edition

## Advisories (161)

### [CVE-2025-54267](https://cve.now/CVE-2025-54267): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 6.5
- Published: Oct 14, 2025
- Affected: through 2.0.2.

### [CVE-2025-54266](https://cve.now/CVE-2025-54266): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: Medium 4.8
- Published: Oct 14, 2025
- Affected: through 2.0.2.

### [CVE-2025-54263](https://cve.now/CVE-2025-54263): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: High 8.1
- Published: Oct 14, 2025
- Affected: through 2.0.2.

### [CVE-2025-54265](https://cve.now/CVE-2025-54265): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 5.9
- Published: Oct 14, 2025
- Affected: through 2.0.2.

### [CVE-2025-54264](https://cve.now/CVE-2025-54264): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.1
- Published: Oct 14, 2025
- Affected: through 2.0.2.

### [CVE-2025-54236](https://cve.now/CVE-2025-54236): Adobe Commerce | Improper Input Validation (CWE-20)

- Severity: Critical 9.1 · KEV
- Published: Sep 9, 2025
- Affected: through 2.0.2.

### [CVE-2025-49556](https://cve.now/CVE-2025-49556): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: High 7.5
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49557](https://cve.now/CVE-2025-49557): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49558](https://cve.now/CVE-2025-49558): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

- Severity: Medium 5.9
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49554](https://cve.now/CVE-2025-49554): Adobe Commerce | Improper Input Validation (CWE-20)

- Severity: High 7.5
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49559](https://cve.now/CVE-2025-49559): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

- Severity: Medium 5.3
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49555](https://cve.now/CVE-2025-49555): Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

- Severity: High 8.1
- Published: Aug 12, 2025
- Affected: through 2.0.2.

### [CVE-2025-49550](https://cve.now/CVE-2025-49550): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 4.3
- Published: Jun 25, 2025
- Affected: through 2.0.2.

### [CVE-2025-49549](https://cve.now/CVE-2025-49549): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Low 2.7
- Published: Jun 25, 2025
- Affected: through 2.0.2.

### [CVE-2025-27206](https://cve.now/CVE-2025-27206): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 5.3
- Published: Jun 10, 2025
- Affected: through 2.0.2.

### [CVE-2025-43585](https://cve.now/CVE-2025-43585): Adobe Commerce | Improper Authorization (CWE-285)

- Severity: High 8.2
- Published: Jun 10, 2025
- Affected: through 2.0.2.

### [CVE-2025-27190](https://cve.now/CVE-2025-27190): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 5.3
- Published: Apr 8, 2025
- Affected: through 2.0.2.

### [CVE-2025-27191](https://cve.now/CVE-2025-27191): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 5.3
- Published: Apr 8, 2025
- Affected: through 2.0.2.

### [CVE-2025-27192](https://cve.now/CVE-2025-27192): Adobe Commerce | Insufficiently Protected Credentials (CWE-522)

- Severity: Low 2.7
- Published: Apr 8, 2025
- Affected: through 2.0.2.

### [CVE-2025-24414](https://cve.now/CVE-2025-24414): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24437](https://cve.now/CVE-2025-24437): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 5.4
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24434](https://cve.now/CVE-2025-24434): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Critical 9.1
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24415](https://cve.now/CVE-2025-24415): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24411](https://cve.now/CVE-2025-24411): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: High 8.1
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24416](https://cve.now/CVE-2025-24416): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24413](https://cve.now/CVE-2025-24413): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24432](https://cve.now/CVE-2025-24432): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

- Severity: Low 3.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24424](https://cve.now/CVE-2025-24424): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 6.5
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24430](https://cve.now/CVE-2025-24430): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

- Severity: Low 3.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24429](https://cve.now/CVE-2025-24429): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Low 3.5
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24436](https://cve.now/CVE-2025-24436): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 4.3
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24438](https://cve.now/CVE-2025-24438): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24406](https://cve.now/CVE-2025-24406): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

- Severity: High 7.5
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24417](https://cve.now/CVE-2025-24417): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24409](https://cve.now/CVE-2025-24409): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: High 8.2
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24425](https://cve.now/CVE-2025-24425): Adobe Commerce | Business Logic Errors (CWE-840)

- Severity: Medium 5.3
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24421](https://cve.now/CVE-2025-24421): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 4.3
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24412](https://cve.now/CVE-2025-24412): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24427](https://cve.now/CVE-2025-24427): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 6.5
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24428](https://cve.now/CVE-2025-24428): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: Medium 5.4
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24410](https://cve.now/CVE-2025-24410): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.7
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24408](https://cve.now/CVE-2025-24408): Adobe Commerce | Information Exposure (CWE-200)

- Severity: Medium 6.5
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2025-24435](https://cve.now/CVE-2025-24435): Adobe Commerce | Improper Access Control (CWE-284)

- Severity: Medium 4.3
- Published: Feb 11, 2025
- Affected: through 2.0.2.

### [CVE-2024-39419](https://cve.now/CVE-2024-39419): A user without ship permissions can ship the orders

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39403](https://cve.now/CVE-2024-39403): Stored XSS through Webhook module public key configuration

- Severity: High 7.6
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39418](https://cve.now/CVE-2024-39418): Adobe Commerce | Improper Authorization (CWE-285)

- Severity: Medium 5.4
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39413](https://cve.now/CVE-2024-39413): An unauthorized user can export the Invoiced Sales Report

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39399](https://cve.now/CVE-2024-39399): \[Paris\] Path Traversal lead to local file read

- Severity: High 7.7
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39417](https://cve.now/CVE-2024-39417): An unauthorized user can export the Shipping Report

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39407](https://cve.now/CVE-2024-39407): Adobe Commerce | Improper Authorization (CWE-285)

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39398](https://cve.now/CVE-2024-39398): OTP 2FA can be bruteforced

- Severity: High 7.4
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39401](https://cve.now/CVE-2024-39401): Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

- Severity: High 8.4
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39411](https://cve.now/CVE-2024-39411): Adobe Commerce | Improper Authorization (CWE-285)

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39416](https://cve.now/CVE-2024-39416): Unauthorized user can export Orders Sale Report

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39414](https://cve.now/CVE-2024-39414): Being able to import/export tax rates without proper privileges

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39402](https://cve.now/CVE-2024-39402): Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

- Severity: High 8.4
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39400](https://cve.now/CVE-2024-39400): DOM XSS through integrations can impact other admins

- Severity: High 8.1
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39404](https://cve.now/CVE-2024-39404): A user without Shop Policy Parameters section privilege can alter the shop policy parameters section

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39415](https://cve.now/CVE-2024-39415): An unauthorized user can export the Tax Sales Report

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-39405](https://cve.now/CVE-2024-39405): Adobe Commerce | Improper Authorization (CWE-285)

- Severity: Medium 4.3
- Published: Aug 14, 2024
- Affected: through 2.0.2.

### [CVE-2024-20758](https://cve.now/CVE-2024-20758): Adobe Commerce | Improper Input Validation (CWE-20)

- Severity: Critical 9.0
- Published: Apr 10, 2024
- Affected: through 2.0.2.

### [CVE-2024-20759](https://cve.now/CVE-2024-20759): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

- Severity: High 8.1
- Published: Apr 10, 2024
- Affected: through 2.0.2.

### [CVE-2024-20716](https://cve.now/CVE-2024-20716): Force high-usage of resources by generating unlimited coupons: Adobe Commerce

- Severity: Medium 4.9
- Published: Feb 15, 2024
- Affected: through 2.0.2.

### [CVE-2024-20718](https://cve.now/CVE-2024-20718): \[Spain\] CSRF to delete Requisition Lists at Adobe Commerce

- Severity: Medium 4.3
- Published: Feb 15, 2024
- Affected: through 2.0.2.

### [CVE-2024-20719](https://cve.now/CVE-2024-20719): \[Adobe Commerce\] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

- Severity: Critical 9.1
- Published: Feb 15, 2024
- Affected: through 2.0.2.

### [CVE-2024-20720](https://cve.now/CVE-2024-20720): Command injection in data collector backup due to insufficient patching of CVE-2023-38208

- Severity: Critical 9.1
- Published: Feb 15, 2024
- Affected: through 2.0.2.

### [CVE-2023-38251](https://cve.now/CVE-2023-38251): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

- Severity: Medium 5.3
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38219](https://cve.now/CVE-2023-38219): Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

- Severity: High 8.7
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38220](https://cve.now/CVE-2023-38220): Full page cache enumeration via cookie X-Magento-Vary

- Severity: High 7.5
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-26367](https://cve.now/CVE-2023-26367): Error based file extraction via PHP filter chains during product bulk import logic

- Severity: Medium 4.9
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-26366](https://cve.now/CVE-2023-26366): Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

- Severity: Medium 6.8
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38218](https://cve.now/CVE-2023-38218): Incorrect Authorization - Customer account takeover

- Severity: High 8.8
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38250](https://cve.now/CVE-2023-38250): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

- Severity: High 8.0
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38249](https://cve.now/CVE-2023-38249): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

- Severity: High 8.0
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2023-38221](https://cve.now/CVE-2023-38221): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

- Severity: High 8.0
- Published: Oct 13, 2023
- Affected: through 2.0.2.

### [CVE-2022-24093](https://cve.now/CVE-2022-24093): Adobe Commerce post-auth improper input validation leads to remote code execution

- Severity: Critical 9.1
- Published: Sep 12, 2023
- Affected: through 2.0.2.

### [CVE-2021-36036](https://cve.now/CVE-2021-36036): Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

- Severity: High 7.2
- Published: Sep 6, 2023
- Affected: through 2.0.2.

### [CVE-2021-36021](https://cve.now/CVE-2021-36021): Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

- Severity: High 7.2
- Published: Sep 6, 2023
- Affected: through 2.0.2.

### [CVE-2021-36023](https://cve.now/CVE-2021-36023): Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 6, 2023
- Affected: through 2.0.2.

### [CVE-2023-38207](https://cve.now/CVE-2023-38207): Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read

- Severity: High 7.5
- Published: Aug 9, 2023
- Affected: through 2.0.2.

### [CVE-2023-38208](https://cve.now/CVE-2023-38208): Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

- Severity: Critical 9.1
- Published: Aug 9, 2023
- Affected: through 2.0.2.

### [CVE-2023-38209](https://cve.now/CVE-2023-38209): Adobe Commerce Incorrect Authorization Security feature bypass

- Severity: Medium 6.5
- Published: Aug 9, 2023
- Affected: through 2.0.2.

### [CVE-2023-29297](https://cve.now/CVE-2023-29297): Admin-to-admin stored XSS via cache poisoning

- Severity: Critical 9.1
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29296](https://cve.now/CVE-2023-29296): \[Cloud\] Customer suspects IDOR vulnerability

- Severity: Medium 4.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29295](https://cve.now/CVE-2023-29295): Insecure Direct Object Reference (IDOR) in Create Quote Function

- Severity: Medium 4.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29294](https://cve.now/CVE-2023-29294): Bypass Purchase Order Approval using Company User in Adobe Commerce B2B

- Severity: Medium 4.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29293](https://cve.now/CVE-2023-29293): Adobe Commerce | Improper Input Validation (CWE-20)

- Severity: Low 2.7
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29292](https://cve.now/CVE-2023-29292): Server Side Request Forgery (SSRF) in FedEx carrier integration configuration

- Severity: Medium 4.9
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29291](https://cve.now/CVE-2023-29291): Server Side Request Forgery (SSRF) in USPS carrier integration configuration

- Severity: Medium 4.9
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29290](https://cve.now/CVE-2023-29290): Adobe Commerce Guest Cart Shipping Address Overwrite IDOR

- Severity: Medium 5.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29289](https://cve.now/CVE-2023-29289): Adobe Commerce XML Injection Security feature bypass

- Severity: Medium 6.5
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29288](https://cve.now/CVE-2023-29288): Adobe Commerce | Incorrect Authorization (CWE-863)

- Severity: Medium 4.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-29287](https://cve.now/CVE-2023-29287): Adobe Commerce Information Exposure Security feature bypass

- Severity: Medium 5.3
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-22248](https://cve.now/CVE-2023-22248): Adobe Commerce Incorrect Authorization Security feature bypass

- Severity: High 7.5
- Published: Jun 15, 2023
- Affected: through 2.0.2.

### [CVE-2023-22251](https://cve.now/CVE-2023-22251): Adobe Commerce Incorrect Authorization Security feature bypass

- Severity: Medium 4.3
- Published: Mar 27, 2023
- Affected: through 2.0.2.

### [CVE-2023-22250](https://cve.now/CVE-2023-22250): Adobe Commerce Improper Access Control Security feature bypass

- Severity: Medium 5.3
- Published: Mar 27, 2023
- Affected: through 2.0.2.

### [CVE-2023-22247](https://cve.now/CVE-2023-22247): Adobe Commerce XML Injection Arbitrary file system read

- Severity: High 7.5
- Published: Mar 27, 2023
- Affected: through 2.0.2.

### [CVE-2022-35689](https://cve.now/CVE-2022-35689): Adobe Commerce Improper Access Control Security feature bypass

- Severity: Medium 5.3
- Published: Oct 14, 2022
- Affected: through 2.0.2.

### [CVE-2022-35698](https://cve.now/CVE-2022-35698): Adobe Commerce Stored XSS Arbitrary code execution

- Severity: Critical 10.0
- Published: Oct 14, 2022
- Affected: through 2.0.2.

### [CVE-2022-35692](https://cve.now/CVE-2022-35692): Adobe Commerce Improper Access Control Security feature bypass

- Severity: Medium 5.3
- Published: Aug 19, 2022
- Affected: through 2.0.2.

### [CVE-2021-39864](https://cve.now/CVE-2021-39864): Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

- Severity: Medium 6.5
- Published: Oct 15, 2021
- Affected: through 2.0.2.

### [CVE-2021-28567](https://cve.now/CVE-2021-28567): Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission

- Severity: Medium 5.0
- Published: Sep 8, 2021
- Affected: through 2.0.2.

### [CVE-2021-36044](https://cve.now/CVE-2021-36044): Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service

- Severity: High 7.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36027](https://cve.now/CVE-2021-36027): Magento Commerce Stored Cross-site Scripting Vulnerability

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36043](https://cve.now/CVE-2021-36043): Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution

- Severity: High 8.0
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36042](https://cve.now/CVE-2021-36042): Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36030](https://cve.now/CVE-2021-36030): Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation

- Severity: High 7.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36041](https://cve.now/CVE-2021-36041): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36040](https://cve.now/CVE-2021-36040): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36025](https://cve.now/CVE-2021-36025): Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36020](https://cve.now/CVE-2021-36020): Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution

- Severity: High 8.2
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36024](https://cve.now/CVE-2021-36024): Magento Commerce Improper Neutralization of Special Elements Used In A Command

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36031](https://cve.now/CVE-2021-36031): Magento Commerce Path Traversal In \`theme\[preview\_image\]\` Parameter Could Lead To Remote Code Execution

- Severity: High 7.2
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36039](https://cve.now/CVE-2021-36039): Magento Commerce \`quoteId\` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36029](https://cve.now/CVE-2021-36029): Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36026](https://cve.now/CVE-2021-36026): Magento Commerce Stored Cross-site Scripting Vulnerability

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36032](https://cve.now/CVE-2021-36032): Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation

- Severity: High 8.3
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36038](https://cve.now/CVE-2021-36038): Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36028](https://cve.now/CVE-2021-36028): Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36034](https://cve.now/CVE-2021-36034): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36022](https://cve.now/CVE-2021-36022): Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36033](https://cve.now/CVE-2021-36033): Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution

- Severity: Critical 9.1
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36037](https://cve.now/CVE-2021-36037): Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-36012](https://cve.now/CVE-2021-36012): Magento Commerce Gift Card Business Logic Error

- Severity: Medium 6.5
- Published: Sep 1, 2021
- Affected: through 2.0.2.

### [CVE-2021-28584](https://cve.now/CVE-2021-28584): Magento Commerce path traversal vulnerability in child theme store creation

- Severity: Medium 5.4
- Published: Jun 28, 2021
- Affected: through 2.0.2.

### [CVE-2021-28585](https://cve.now/CVE-2021-28585): Magento Commerce improper input validation in customer customer webapi

- Severity: Medium 5.3
- Published: Jun 28, 2021
- Affected: through 2.0.2.

### [CVE-2021-28583](https://cve.now/CVE-2021-28583): Magento Commerce insecure storage of sensitive documentation

- Severity: High 7.5
- Published: Jun 28, 2021
- Affected: through 2.0.2.

### [CVE-2021-28556](https://cve.now/CVE-2021-28556): Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

- Severity: Medium 6.9
- Published: Jun 28, 2021
- Affected: through 2.0.2.

### [CVE-2021-21014](https://cve.now/CVE-2021-21014): Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

- Severity: Critical 9.1
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21016](https://cve.now/CVE-2021-21016): Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

- Severity: Critical 9.1
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21025](https://cve.now/CVE-2021-21025): Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

- Severity: Critical 9.1
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21032](https://cve.now/CVE-2021-21032): Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

- Severity: Medium 5.6
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21020](https://cve.now/CVE-2021-21020): Magento Commerce Improper Access Control Vulnerability

- Severity: Medium 5.3
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21026](https://cve.now/CVE-2021-21026): Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

- Severity: Medium 5.3
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21023](https://cve.now/CVE-2021-21023): Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution

- Severity: Medium 4.8
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21022](https://cve.now/CVE-2021-21022): Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

- Severity: Medium 5.3
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21030](https://cve.now/CVE-2021-21030): Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution

- Severity: High 8.1
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21027](https://cve.now/CVE-2021-21027): Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

- Severity: Medium 4.3
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2021-21031](https://cve.now/CVE-2021-21031): Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

- Severity: Medium 5.6
- Published: Feb 11, 2021
- Affected: through 2.0.2.

### [CVE-2020-24407](https://cve.now/CVE-2020-24407): Arbitrary code execution via file import functionality

- Severity: Critical 9.1
- Published: Nov 9, 2020
- Affected: through 2.0.2.

### [CVE-2020-24403](https://cve.now/CVE-2020-24403): Incorrect permissions could lead to unauthorized modification of inventory source data via REST API

- Severity: Low 2.7
- Published: Nov 9, 2020
- Affected: through 2.0.2.

### [CVE-2020-24401](https://cve.now/CVE-2020-24401): Incorrect permissions following the deletion of a user role or deactivation of a user

- Severity: Medium 6.5
- Published: Nov 9, 2020
- Affected: through 2.0.2.

### [CVE-2020-24402](https://cve.now/CVE-2020-24402): Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API

- Severity: Medium 4.9
- Published: Nov 9, 2020
- Affected: through 2.0.2.

### [CVE-2020-9691](https://cve.now/CVE-2020-9691): Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability.

- Severity: Unrated
- Published: Jul 29, 2020
- Affected: through 2.0.2.

### [CVE-2020-9689](https://cve.now/CVE-2020-9689): Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability.

- Severity: Unrated
- Published: Jul 29, 2020
- Affected: through 2.0.2.

### [CVE-2020-9577](https://cve.now/CVE-2020-9577): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9576](https://cve.now/CVE-2020-9576): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9588](https://cve.now/CVE-2020-9588): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9578](https://cve.now/CVE-2020-9578): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9631](https://cve.now/CVE-2020-9631): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9630](https://cve.now/CVE-2020-9630): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9632](https://cve.now/CVE-2020-9632): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9580](https://cve.now/CVE-2020-9580): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9581](https://cve.now/CVE-2020-9581): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9582](https://cve.now/CVE-2020-9582): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9583](https://cve.now/CVE-2020-9583): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9587](https://cve.now/CVE-2020-9587): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9584](https://cve.now/CVE-2020-9584): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2020-9585](https://cve.now/CVE-2020-9585): Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth…

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: through 2.0.2.

### [CVE-2019-8114](https://cve.now/CVE-2019-8114): A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to…

- Severity: Unrated
- Published: Nov 5, 2019
- Affected: fixed in 1.9.4.3.

### [CVE-2016-6485](https://cve.now/CVE-2016-6485): The \_\_construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the…

- Severity: Unrated
- Published: Mar 1, 2017
- Affected: from 2.0, through 2.0.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/magento/project-community-edition
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.