[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-kU5sNEeba6HXjoUDFnZz_KXExm-DKTSzE9Fyktr5ok":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":38,"kevVulnerabilities":95,"topProductsByCves":101,"seoMetadata":107,"meta":116},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":37},18574,"magento",5,225,1,145,"2023-09-06","m",[16,20,26,30,34],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},105692,141,222,{"id":21,"product_name":22,"version_count":23,"cve_count":11,"kev_count":24,"last_cve_update":25},105691,"advanced_newsletter",4,0,"2020-03-09",{"id":27,"product_name":28,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":29},105693,"magento2","2017-03-01",{"id":31,"product_name":32,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":33},105694,"upward_connector","2021-02-25",{"id":35,"product_name":36,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":33},105695,"upward_php","Magento is a technology vendor with 5 tracked products and 225 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[39,47,54,61,66,73,77,82,87,91],{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":44,"severity":45,"isKev":4,"epssScore":46},"CVE-2022-24086","Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.","2022-02-16",9.8,"v3.1","Critical",0.99199,{"cveId":48,"description":49,"publishedDate":50,"cvssScore":43,"cvssVersion":51,"severity":45,"isKev":52,"epssScore":53},"CVE-2016-4010","Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.","2017-01-23","v3.0",false,0.92869,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":58,"cvssVersion":44,"severity":59,"isKev":52,"epssScore":60},"CVE-2021-21029","Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.","2021-02-11",4.8,"Medium",0.84641,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":58,"cvssVersion":44,"severity":59,"isKev":52,"epssScore":65},"CVE-2022-34258","Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.","2022-08-16",0.69188,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":71,"severity":59,"isKev":52,"epssScore":72},"CVE-2015-1397","SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.","2015-04-29",6.5,"v2",0.5577,{"cveId":74,"description":75,"publishedDate":69,"cvssScore":9,"cvssVersion":71,"severity":59,"isKev":52,"epssScore":76},"CVE-2015-3457","Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote attackers to bypass authentication via the forwarded parameter.",0.25054,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":43,"cvssVersion":51,"severity":45,"isKev":52,"epssScore":81},"CVE-2019-7139","An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","2019-04-10",0.22242,{"cveId":83,"description":84,"publishedDate":85,"cvssScore":43,"cvssVersion":44,"severity":45,"isKev":52,"epssScore":86},"CVE-2020-3716","Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.","2020-01-29",0.13964,{"cveId":88,"description":89,"publishedDate":69,"cvssScore":70,"cvssVersion":71,"severity":59,"isKev":52,"epssScore":90},"CVE-2015-1398","Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.",0.13926,{"cveId":92,"description":93,"publishedDate":69,"cvssScore":70,"cvssVersion":71,"severity":59,"isKev":52,"epssScore":94},"CVE-2015-1399","PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.",0.09737,[96],{"cveId":40,"description":41,"publishedDate":42,"cvssScore":43,"cvssVersion":44,"severity":45,"isKev":4,"epssScore":46,"cisaVulnName":97,"cisaDateAdded":98,"cisaShortDescription":99,"cisaRequiredAction":100},"Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability","2022-02-15","Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.","Apply updates per vendor instructions.",[102,103,104,105,106],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":11,"kev_count":24,"last_cve_update":25},{"id":27,"product_name":28,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":29},{"id":31,"product_name":32,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":33},{"id":35,"product_name":36,"version_count":24,"cve_count":11,"kev_count":24,"last_cve_update":33},{"title":108,"metaDescription":109,"keywords":110,"structuredData":111},"Magento - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Magento covering 5 products with 225 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Magento vulnerabilities, Magento security, Magento CVE, Magento threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Magento KEV, Magento exploited vulnerabilities",{"@context":112,"@type":113,"name":114,"description":109,"url":115},"https:\u002F\u002Fschema.org","Organization","Magento","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fmagento",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":117,"apiVersion":118},"2026-10-28T15:58:44.389Z","3.0"]