Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Adobe Commerce — Vulnerabilities & Security Advisories 210

All 210 CVE vulnerabilities found in Adobe Commerce, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the Adobe Commerce vendor and product under the general category of software weakness types. It collects a comprehensive list of security flaws, ranging from critical remote code execution risks to minor configuration issues, covering the time period from early 2019 through the present day. By examining this curated data, users can effectively track Adobe’s security advisories to stay informed about recent patch releases, understand the characteristics and impact of specific weakness classes prevalent in e-commerce platforms, and look up a detailed history of vulnerabilities affecting this specific product. This resource serves as a central reference for security professionals, developers, and system administrators who need to assess the risk posture of their Adobe Commerce deployments. The information includes details on affected versions, exploit availability, and remediation guidance where applicable. Reviewing these entries helps organizations prioritize their patching strategies and ensures that known security gaps are addressed promptly. The data is organized to facilitate easy searching by vulnerability identifier, severity score, or release date, allowing for efficient integration into vulnerability management workflows. Understanding the historical context of these weaknesses provides valuable insights into the evolution of security practices within the Adobe ecosystem and helps predict potential future risks based on past trends and patterns in code quality and dependency management.

Vendor: Adobe

CVE ID Title CVSS Severity Published
CVE-2024-45118 Adobe Commerce | Improper Access Control (CWE-284) CWE-284 6.5 Medium 2024-10-10
CVE-2024-45125 Adobe Commerce | Incorrect Authorization (CWE-863) CWE-863 4.3 Medium 2024-10-10
CVE-2024-45149 Adobe Commerce | Improper Access Control (CWE-284) CWE-284 2.7 Low 2024-10-10
CVE-2024-39419 A user without ship permissions can ship the orders CWE-285 4.3 Medium 2024-08-14
CVE-2024-39403 Stored XSS through Webhook module public key configuration CWE-79 7.6 High 2024-08-14
CVE-2024-39418 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 5.4 Medium 2024-08-14
CVE-2024-39413 An unauthorized user can export the Invoiced Sales Report CWE-285 4.3 Medium 2024-08-14
CVE-2024-39408 Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) CWE-352 4.3 Medium 2024-08-14
CVE-2024-39399 [Paris] Path Traversal lead to local file read CWE-22 7.7 High 2024-08-14
CVE-2024-39417 An unauthorized user can export the Shipping Report CWE-285 4.3 Medium 2024-08-14
CVE-2024-39410 Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) CWE-352 4.3 Medium 2024-08-14
CVE-2024-39398 OTP 2FA can be bruteforced CWE-307 7.4 High 2024-08-14
CVE-2024-39407 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium 2024-08-14
CVE-2024-39401 Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) CWE-78 8.4 High 2024-08-14
CVE-2024-39397 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) CWE-434 9.0 Critical 2024-08-14
CVE-2024-39411 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium 2024-08-14
CVE-2024-39409 Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) CWE-352 4.3 Medium 2024-08-14
CVE-2024-39416 Unauthorized user can export Orders Sale Report CWE-285 4.3 Medium 2024-08-14
CVE-2024-39414 Being able to import/export tax rates without proper privileges CWE-284 4.3 Medium 2024-08-14
CVE-2024-39412 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium 2024-08-14
CVE-2024-39406 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 6.8 Medium 2024-08-14
CVE-2024-39402 Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) CWE-78 8.4 High 2024-08-14
CVE-2024-39400 DOM XSS through integrations can impact other admins CWE-79 8.1 High 2024-08-14
CVE-2024-39404 A user without Shop Policy Parameters section privilege can alter the shop policy parameters section CWE-285 4.3 Medium 2024-08-14
CVE-2024-39405 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium 2024-08-14
CVE-2024-39415 An unauthorized user can export the Tax Sales Report CWE-285 4.3 Medium 2024-08-14
CVE-2024-34106 Insecure Direct Object Reference - An attacker can able to erase the victim quote details CWE-863 5.3 Medium 2024-06-13
CVE-2024-34109 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 7.2 High 2024-06-13
CVE-2024-34103 Customer account takeover via web API call & subsequent password reset CWE-287 8.1 High 2024-06-13
CVE-2024-34110 RCE in the Adobe Commerce Webhook module through a legit webhook definition CWE-434 7.2 High 2024-06-13

All 210 known CVE vulnerabilities affecting Adobe Commerce with full Chinese analysis, references, and POCs where available.