Skip to main content

CVE mentions, exploit signals, and PoC evidence in one fast public view.

Vendor archive

magento CVEs

Beta · best-effort

224 CVEs tagged to vendor magento — 32 Critical, 70 High, 118 Medium, 4 Low, 0 Unrated.

See this archive with more filters View vendor evidence profile Explore

CVE-2020-9664

Published Jul 22, 2020

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2020-9632

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploi…

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2020-9631

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploi…

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2020-9630

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic error vulnerability. Successful exploitation…

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2020-9591

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Success…

CVSS 7.5 · High

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9588

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful ex…

CVSS 7.2 · High

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9587

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypass vulnerability. Successful exploitatio…

CVSS 7.5 · High

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9585

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Success…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9584

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful explo…

CVSS 5.4 · Medium

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9583

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation co…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9582

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation co…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9581

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful explo…

CVSS 6.1 · Medium

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9580

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploi…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9579

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation bypass vulnerability. Successful exploi…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9578

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation co…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9577

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful explo…

CVSS 6.1 · Medium

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2020-9576

Published Jun 26, 2020

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerability. Successful exploitation co…

CVSS 9.8 · Critical

evidence mentions: 1
Buzz score: 11.9

Vendor/product tagsBeta · best-effort

CVE-2014-1634

Published Mar 9, 2020

SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category_id/ PATH_INFO.

CVSS 9.8 · Critical

Vendor/product tagsBeta · best-effort

CVE-2020-3758

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation cou…

CVSS 6.1 · Medium

evidence mentions: 2
Buzz score: 17.5

Vendor/product tagsBeta · best-effort

CVE-2020-3719

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to se…

CVSS 7.5 · High

evidence mentions: 3
Buzz score: 21.9

Vendor/product tagsBeta · best-effort

CVE-2020-3718

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to a…

CVSS 9.8 · Critical

evidence mentions: 3
Buzz score: 21.9

Vendor/product tagsBeta · best-effort

CVE-2020-3717

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. Successful exploitation could lead to se…

CVSS 5.3 · Medium

evidence mentions: 2
Buzz score: 17.5

Vendor/product tagsBeta · best-effort

CVE-2020-3716

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitati…

CVSS 9.8 · Critical

evidence mentions: 3
Buzz score: 21.9

Vendor/product tagsBeta · best-effort

CVE-2020-3715

Published Jan 29, 2020

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation cou…

CVSS 6.1 · Medium

evidence mentions: 2
Buzz score: 17.5

Vendor/product tagsBeta · best-effort

CVE-2015-6497

Published Jan 15, 2020

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used…

CVSS 8.8 · High

Vendor/product tagsBeta · best-effort

Showing 51-75 of 224 CVEsPage 3 of 9