Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Adobe Commerce — Vulnerabilities & Security Advisories 210

All 210 CVE vulnerabilities found in Adobe Commerce, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the Adobe Commerce vendor and product under the general category of software weakness types. It collects a comprehensive list of security flaws, ranging from critical remote code execution risks to minor configuration issues, covering the time period from early 2019 through the present day. By examining this curated data, users can effectively track Adobe’s security advisories to stay informed about recent patch releases, understand the characteristics and impact of specific weakness classes prevalent in e-commerce platforms, and look up a detailed history of vulnerabilities affecting this specific product. This resource serves as a central reference for security professionals, developers, and system administrators who need to assess the risk posture of their Adobe Commerce deployments. The information includes details on affected versions, exploit availability, and remediation guidance where applicable. Reviewing these entries helps organizations prioritize their patching strategies and ensures that known security gaps are addressed promptly. The data is organized to facilitate easy searching by vulnerability identifier, severity score, or release date, allowing for efficient integration into vulnerability management workflows. Understanding the historical context of these weaknesses provides valuable insights into the evolution of security practices within the Adobe ecosystem and helps predict potential future risks based on past trends and patterns in code quality and dependency management.

Vendor: Adobe

CVE ID Title CVSS Severity Published
CVE-2024-34111 SSRF in service connector CWE-918 6.5 Medium 2024-06-13
CVE-2024-34105 Stored Cross Site Scripting in Order Comment CWE-79 4.8 Medium 2024-06-13
CVE-2024-34107 Adobe Commerce | Improper Access Control (CWE-284) CWE-284 5.3 Medium 2024-06-13
CVE-2024-34104 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 8.2 High 2024-06-13
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access CWE-611 9.8 Critical 2024-06-13
CVE-2024-34108 Large attack surface through legit webhook usage in Adobe Commerce CWE-20 9.1 Critical 2024-06-13
CVE-2024-20758 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 9.0 Critical 2024-04-10
CVE-2024-20759 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) CWE-79 8.1 High 2024-04-10
CVE-2024-20716 Force high-usage of resources by generating unlimited coupons: Adobe Commerce CWE-400 4.9 Medium 2024-02-15
CVE-2024-20717 Stored admin XSS via PayPal authentication certificate CWE-79 5.4 Medium 2024-02-15
CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce CWE-352 4.3 Medium 2024-02-15
CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297 CWE-79 9.1 Critical 2024-02-15
CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208 CWE-78 9.1 Critical 2024-02-15
CVE-2023-38251 Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) CWE-400 5.3 Medium 2023-10-13
CVE-2023-38219 Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping CWE-79 8.7 High 2023-10-13
CVE-2023-38220 Full page cache enumeration via cookie X-Magento-Vary CWE-285 7.5 High 2023-10-13
CVE-2023-26367 Error based file extraction via PHP filter chains during product bulk import logic CWE-20 4.9 Medium 2023-10-13
CVE-2023-26366 Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 6.8 Medium 2023-10-13
CVE-2023-38218 Incorrect Authorization - Customer account takeover CWE-863 8.8 High 2023-10-13
CVE-2023-38250 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High 2023-10-13
CVE-2023-38249 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High 2023-10-13
CVE-2023-38221 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) CWE-89 8.0 High 2023-10-13
CVE-2022-24093 Adobe Commerce post-auth improper input validation leads to remote code execution CWE-20 9.1 Critical 2023-09-12
CVE-2021-36036 Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution CWE-284 7.2 High 2023-09-06
CVE-2021-36021 Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution CWE-20 7.2 High 2023-09-06
CVE-2021-36023 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution CWE-78 9.1 Critical 2023-09-06
CVE-2023-38207 Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read CWE-91 7.5 High 2023-08-09
CVE-2023-29293 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 2.7 Low 2023-06-15
CVE-2023-29288 Adobe Commerce | Incorrect Authorization (CWE-863) CWE-863 4.3 Medium 2023-06-15
CVE-2022-42344 [CVE-2021-36032] Magento IDOR Leads to Account Takeover CWE-863 8.8 High 2022-10-20

All 210 known CVE vulnerabilities affecting Adobe Commerce with full Chinese analysis, references, and POCs where available.