p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de magento/community-edition · Page n° 2

Vulnérabilité publiée pour magento/community-edition au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 360

  1. CVE-2025-27188

    Moyenne · CVSS 4.3EPSS 0,58%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12, 2.4.8-beta2 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p13
    • Mettez à jour vers 2.4.5-p12
    • Mettez à jour vers 2.4.6-p10
    • Mettez à jour vers 2.4.7-p5
    • Mettez à jour vers 2.4.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2025-24414

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2025-24437

    Moyenne · CVSS 5.4EPSS 0,45%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view or modify select information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2025-24434

    Critique · CVSS 9.1EPSS 17,19%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    • Mettez à jour vers 2.4.8-beta2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2025-24415

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2025-24411

    Élevée · CVSS 8.1EPSS 0,91%Correctif disponible

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access affecting Confidentiality and Integrity. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2025-24416

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2025-24413

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2025-24432

    Faible · CVSS 3.7EPSS 0,4%Correctif disponible

    Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2025-24424

    Moyenne · CVSS 6.5EPSS 0,77%Correctif disponible

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2025-24430

    Faible · CVSS 3.7EPSS 0,4%Correctif disponible

    Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing rate limiting mechanisms. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2025-24429

    Faible · CVSS 3.5EPSS 0,5%Correctif disponible

    Adobe Commerce | Improper Access Control (CWE-284)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass allowing read only access. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2025-24436

    Moyenne · CVSS 4.3EPSS 0,55%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view select information. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2025-24438

    Élevée · CVSS 8.7EPSS 0,8%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2025-24406

    Élevée · CVSS 7.5EPSS 1,4%Correctif disponible

    Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  16. CVE-2025-24417

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  17. CVE-2025-24409

    Élevée · CVSS 8.2EPSS 0,68%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access, leading to both a High impact to confidentiality and Low impact to integrity. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  18. CVE-2025-24425

    Moyenne · CVSS 5.3EPSS 0,63%Correctif disponible

    Adobe Commerce | Business Logic Errors (CWE-840)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  19. CVE-2025-24421

    Moyenne · CVSS 4.3EPSS 0,55%Correctif disponible

    Adobe Commerce | Incorrect Authorization (CWE-863)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to read select data. Exploitation of this issue does not require user interaction

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  20. CVE-2025-24412

    Élevée · CVSS 8.7EPSS 0,7%Correctif disponible

    Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.

    magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-edition magento/community-editionPHP
    • Mettez à jour vers 2.4.4-p12
    • Mettez à jour vers 2.4.5-p11
    • Mettez à jour vers 2.4.6-p9
    • Mettez à jour vers 2.4.7-p4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →