{"kind": "product", "path": "vulns/packagist/craftcms%2Fcommerce", "name": "craftcms/commerce", "product": "craftcms/commerce", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-55795", "noindex": false, "published": "2026-09-14T15:55:14.000Z", "modified": "2026-09-14T20:06:54.939Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00512, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-55795", "title": "Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass", "description": "Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm", "https://github.com/craftcms/commerce/commit/a7d365cc33dc4c60c543defb3458bcdb5749bc13", "https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5"], "fixes": ["4.11.2", "5.6.5"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "GHSA-78vr-q6cf-c7p6", "noindex": false, "published": "2026-06-19T21:15:23Z", "modified": "2026-09-10T03:50:48.689302452Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-78vr-q6cf-c7p6", "title": "Craft Commerce: Partial Payment Amount Without Lower Bound Validation", "description": "### Summary\n\nThe `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check. \n\n### Details\n\nWhen the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.\n\n<img width=\"690\" height=\"80\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73\" />\n\n<img width=\"761\" height=\"200\" alt=\"image\" src=\"https://github.com/", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-78vr-q6cf-c7p6", "https://github.com/craftcms/commerce/commit/9a88392b3074aa132a9455d4f4b582411df52c74", "https://github.com/craftcms/commerce"], "fixes": ["4.11.2", "5.6.5"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-32272", "noindex": false, "published": "2026-04-13T20:25:50.420Z", "modified": "2026-04-14T16:28:47.197Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00304, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-32272", "title": "Craft Commerce: Blind SQL Injection via hasVariant/hasProduct", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the input sanitization blocklist added to ElementIndexesController in a prior security fix (GHSA-2453-mppf-46cj). The blocklist only strips top-level Yii2 Query properties such as where and orderBy, but hasVariant and hasProduct pass through untouched and internally call Craft::configure() on a subquery without sanitization, re-introducing SQL injection. Any authenticated control panel user can exploit this via boolean-based blind SQL inj", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-r54v-qq87-px5r", "https://github.com/craftcms/commerce/pull/4232", "https://github.com/advisories/GHSA-2453-mppf-46cj"], "fixes": ["5.6.0"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-32271", "noindex": false, "published": "2026-04-13T20:19:19.486Z", "modified": "2026-04-16T13:26:40.649Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00476, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-32271", "title": "Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp ", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88", "https://github.com/craftcms/commerce/commit/6d2d24b3a2b0c06593856d05446f82bd8af92d72", "https://nvd.nist.gov/vuln/detail/CVE-2026-32271"], "fixes": ["4.10.3", "5.5.5"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-32270", "noindex": false, "published": "2026-04-13T20:08:05.032Z", "modified": "2026-04-14T15:25:04.635Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-32270", "title": "Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf", "https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08", "https://github.com/craftcms/commerce/releases/tag/4.11.0"], "fixes": ["4.11.0", "5.6.0"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-31867", "noindex": false, "published": "2026-03-11T17:52:18.298Z", "modified": "2026-03-12T13:49:48.940Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00289, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-31867", "title": "Craft Commerce has a Potential IDOR in Commerce carts", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq", "https://github.com/craftcms/commerce/pull/4207", "https://nvd.nist.gov/vuln/detail/CVE-2026-31867"], "fixes": ["4.11.0", "5.6.0"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29177", "noindex": false, "published": "2026-03-10T20:01:06.968Z", "modified": "2026-03-10T20:12:39.344Z", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "low", "epss": 0.00219, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29177", "title": "Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Craft Commerce Order details. Malicious JavaScript can be injected via the Shipping Method Name, Order Reference, or Site Name. When a user opens the order details slideout via a double-click on the order index page, the injected payload executes. This vulnerability is fixed in 4.10.2 and 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-mj32-r678-7mvp", "https://github.com/craftcms/commerce/commit/b0683e04773f16bba6af9df18aab495fc5dde68a", "https://nvd.nist.gov/vuln/detail/CVE-2026-29177"], "fixes": ["4.10.2", "5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29176", "noindex": false, "published": "2026-03-10T19:59:48.366Z", "modified": "2026-03-10T20:12:39.491Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00243, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29176", "title": "Craft Commerce has Stored XSS in Inventory Location Name", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The Name field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. This vulnerability is fixed in 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-wj89-2385-gpx3", "https://github.com/craftcms/commerce/commit/da143df084563ddf0929d7c261bcc11d312e8004", "https://nvd.nist.gov/vuln/detail/CVE-2026-29176"], "fixes": ["5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29175", "noindex": false, "published": "2026-03-10T19:57:36.799Z", "modified": "2026-03-11T14:11:09.100Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00212, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29175", "title": "Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-cfpv-rmpf-f624", "https://github.com/craftcms/commerce/commit/9f0638a4fb29ed8295a463385a7cc49ec986e33a", "https://nvd.nist.gov/vuln/detail/CVE-2026-29175"], "fixes": ["5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29174", "noindex": false, "published": "2026-03-10T19:55:54.645Z", "modified": "2026-03-10T20:12:39.918Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00453, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29174", "title": "Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j", "https://github.com/craftcms/commerce/commit/094d69df24b925544f337c38e2ec1effcd5395c7", "https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b"], "fixes": ["5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29173", "noindex": false, "published": "2026-03-10T19:54:25.064Z", "modified": "2026-03-10T20:12:40.044Z", "cvss": 1.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P", "severity": "low", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29173", "title": "Craft Commerce has Stored XSS while updating Order Status from Orders Table", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to update the Order Status from the Commerce Orders Table. The Order Status Name is rendered without proper escaping, allowing script execution to occur. This vulnerability is fixed in 4.10.2 and 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-mqxf-2998-c6cp", "https://github.com/craftcms/commerce/commit/60cdc505c03b6fa2f59715e8c060114b66334afa", "https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b"], "fixes": ["4.10.2", "5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-29172", "noindex": false, "published": "2026-03-10T19:52:32.735Z", "modified": "2026-03-11T14:12:53.450Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00437, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-29172", "title": "Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting", "description": "Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw", "https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276", "https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1"], "fixes": ["4.10.2", "5.5.3"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25522", "noindex": false, "published": "2026-02-03T18:10:33.911Z", "modified": "2026-02-03T19:22:34.780Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25522", "title": "Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-h9r9-2pxg-cx9m", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25490", "noindex": false, "published": "2026-02-03T18:09:33.290Z", "modified": "2026-02-03T20:27:49.508Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25490", "title": "Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-wq2m-r96q-crrf", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25489", "noindex": false, "published": "2026-02-03T18:07:40.168Z", "modified": "2026-02-03T20:34:09.676Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00327, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25489", "title": "Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-v585-mf6r-rqrc", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25488", "noindex": false, "published": "2026-02-03T18:07:25.106Z", "modified": "2026-02-04T21:13:48.706Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00305, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25488", "title": "Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Tax Categories (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-p6w8-q63m-72c8", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25487", "noindex": false, "published": "2026-02-03T18:07:12.401Z", "modified": "2026-02-04T21:13:17.130Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25487", "title": "Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator's browser. This occurs because the Tax Rates 'Name' field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-wqc5-485v-3hqh", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25486", "noindex": false, "published": "2026-02-03T18:06:57.014Z", "modified": "2026-02-04T21:10:12.885Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25486", "title": "Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation", "description": "Craft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Methods Name field in the Store Management section is not properly sanitized before being displayed in the admin panel. This issue has been patched in version 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-g92v-wpv7-6w22", "https://github.com/craftcms/commerce/commit/fa273330807807d05b564d37c88654cd772839ee", "https://github.com/craftcms/commerce/releases/tag/5.5.2"], "fixes": ["5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25484", "noindex": false, "published": "2026-02-03T18:06:36.706Z", "modified": "2026-02-04T16:51:13.282Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25484", "title": "Craft Commerce has Stored XSS in Product Type Name", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input (source) is in Commerce (Product Type settings), but the sink is in CMS user permissions settings. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-2h2m-v2mg-656c", "https://github.com/craftcms/commerce/commit/7e1dedf06038c8e70dce0187b7048d4ab8ffb75c", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-25483", "noindex": false, "published": "2026-02-03T18:05:49.411Z", "modified": "2026-02-04T16:51:19.008Z", "cvss": 6.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "severity": "medium", "epss": 0.00347, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-25483", "title": "Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration", "description": "Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exists in Craft Commerce’s Order Status History Message. The message is rendered using the |md filter, which permits raw HTML, enabling malicious script execution. If a user has database backup utility permissions (which do not require an elevated session), an attacker can exfiltrate the entire database, including all user credentials, customer PII, order history, and 2FA recovery codes. This issue has been patched in versions 4.10.1 and 5.5.2.", "references": ["https://github.com/craftcms/commerce/security/advisories/GHSA-8478-rmjg-mjj5", "https://github.com/craftcms/commerce/commit/4665a47c0961aee311a42af2ff94a7c470f0ad8c", "https://github.com/craftcms/commerce/releases/tag/4.10.1"], "fixes": ["4.10.1", "5.5.2"], "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}, {"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}]}], "total": 21, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "craftcms/commerce", "path": "vulns/packagist/craftcms%2Fcommerce", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-14T20:06:54.939Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}