Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Adobe Commerce — Vulnerabilities & Security Advisories 154

All 154 CVE vulnerabilities found in Adobe Commerce, with AI-generated Chinese analysis, references, and POCs.

Vendor: Adobe

CVE IDTitleCVSSSeverityPublished
CVE-2024-34106 Insecure Direct Object Reference - An attacker can able to erase the victim quote details CWE-863 5.3 Medium2024-06-13
CVE-2024-34109 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 7.2 High2024-06-13
CVE-2024-34103 Customer account takeover via web API call & subsequent password reset CWE-287 8.1 High2024-06-13
CVE-2024-34110 RCE in the Adobe Commerce Webhook module through a legit webhook definition CWE-434 7.2 High2024-06-13
CVE-2024-34111 SSRF in service connector CWE-918 6.5 Medium2024-06-13
CVE-2024-34105 Stored Cross Site Scripting in Order Comment CWE-79 4.8 Medium2024-06-13
CVE-2024-34107 Adobe Commerce | Improper Access Control (CWE-284) CWE-284 5.3 Medium2024-06-13
CVE-2024-34104 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 8.2 High2024-06-13
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access CWE-611 9.8 Critical2024-06-13
CVE-2024-34108 Large attack surface through legit webhook usage in Adobe Commerce CWE-20 9.1 Critical2024-06-13
CVE-2024-20758 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 9.0 Critical2024-04-10
CVE-2024-20759 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) CWE-79 8.1 High2024-04-10
CVE-2024-20716 Force high-usage of resources by generating unlimited coupons: Adobe Commerce CWE-400 4.9 Medium2024-02-15
CVE-2024-20717 Stored admin XSS via PayPal authentication certificate CWE-79 5.4 Medium2024-02-15
CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce CWE-352 4.3 Medium2024-02-15
CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297 CWE-79 9.1 Critical2024-02-15
CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208 CWE-78 9.1 Critical2024-02-15
CVE-2023-38251 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) CWE-400 5.3 Medium2023-10-13
CVE-2023-38219 Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping CWE-79 8.7 High2023-10-13
CVE-2023-38220 Full page cache enumeration via cookie X-Magento-Vary CWE-285 7.5 High2023-10-13
CVE-2023-26367 Error based file extraction via PHP filter chains during product bulk import logic CWE-20 4.9 Medium2023-10-13
CVE-2023-26366 Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 6.8 Medium2023-10-13
CVE-2023-38218 Incorrect Authorization - Customer account takeover CWE-863 8.8 High2023-10-13
CVE-2023-38250 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High2023-10-13
CVE-2023-38249 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High2023-10-13
CVE-2023-38221 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High2023-10-13
CVE-2022-24093 Adobe Commerce post-auth improper input validation leads to remote code execution CWE-20 9.1 Critical2023-09-12
CVE-2021-36036 Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution CWE-284 7.2 High2023-09-06
CVE-2021-36021 Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution CWE-20 7.2 High2023-09-06
CVE-2021-36023 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution CWE-78 9.1 Critical2023-09-06

All 154 known CVE vulnerabilities affecting Adobe Commerce with full Chinese analysis, references, and POCs where available.