Vulnerabilities

Adobe Commerce 2.4.3

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

63CVEs

CVE-2022-24086

Adobe Commerce checkout improper input validation leads to remote code execution

Published 2022-02-16 · Analyzed

10.0KEVEPSS 0.992

CVE-2024-34102

XXE can expose crypt key and other secrets granting full admin access

Published 2024-06-13 · Analyzed

9.8KEVEPSS 1.000

CVE-2022-34256

Adobe Commerce Improper Authorization Privilege escalation

Published 2022-08-16 · Modified

9.8EPSS 0.021

CVE-2024-45115

Adobe Commerce | Improper Authentication (CWE-287)

Published 2024-10-10 · Analyzed

9.8EPSS 0.013

CVE-2024-34107

Adobe Commerce | Improper Access Control (CWE-284)

Published 2024-06-13 · Modified

9.8EPSS 0.011

CVE-2022-34253

Adobe Commerce XML Injection Arbitrary code execution

Published 2022-08-16 · Modified

9.1EPSS 0.049

CVE-2022-24093

Adobe Commerce post-auth improper input validation leads to remote code execution

Published 2023-09-12 · Modified

9.1EPSS 0.015

CVE-2024-34108

Large attack surface through legit webhook usage in Adobe Commerce

Published 2024-06-13 · Modified

9.1EPSS 0.014

CVE-2023-29297

Admin-to-admin stored XSS via cache poisoning

Published 2023-06-15 · Modified

9.1EPSS 0.014

CVE-2024-20758

Adobe Commerce | Improper Input Validation (CWE-20)

Published 2024-04-10 · Analyzed

9.0EPSS 0.014

CVE-2022-34255

Adobe Commerce Improper Access Control Privilege escalation

Published 2022-08-16 · Modified

8.8EPSS 0.022

CVE-2022-34254

Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Published 2022-08-16 · Modified

8.8EPSS 0.022

CVE-2024-34111

SSRF in service connector

Published 2024-06-13 · Modified

8.8EPSS 0.013

CVE-2022-42344

[CVE-2021-36032] Magento IDOR Leads to Account Takeover

Published 2022-10-20 · Modified

8.8EPSS 0.012

CVE-2023-38218

Incorrect Authorization - Customer account takeover

Published 2023-10-13 · Modified

8.8EPSS 0.008

CVE-2024-45148

Adobe Commerce | Improper Authentication (CWE-287)

Published 2024-10-10 · Analyzed

8.8EPSS 0.007

CVE-2023-38219

Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

Published 2023-10-13 · Modified

8.7EPSS 0.006

CVE-2024-34104

Adobe Commerce | Improper Authorization (CWE-285)

Published 2024-06-13 · Modified

8.2EPSS 0.008

CVE-2024-20759

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Published 2024-04-10 · Analyzed

8.1EPSS 0.010

CVE-2024-45116

Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)

Published 2024-10-10 · Analyzed

8.1EPSS 0.009

CVE-2024-34103

Customer account takeover via web API call & subsequent password reset

Published 2024-06-13 · Modified

8.1EPSS 0.009

CVE-2023-38221

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published 2023-10-13 · Modified

8.0EPSS 0.008

CVE-2023-38249

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published 2023-10-13 · Modified

8.0EPSS 0.008

CVE-2023-38250

Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published 2023-10-13 · Modified

8.0EPSS 0.008

CVE-2024-45117

Adobe Commerce | Improper Input Validation (CWE-20)

Published 2024-10-10 · Analyzed

7.6EPSS 0.008

CVE-2023-22248

Adobe Commerce Incorrect Authorization Security feature bypass

Published 2023-06-15 · Modified

7.5EPSS 0.010

CVE-2023-38220

Full page cache enumeration via cookie X-Magento-Vary

Published 2023-10-13 · Modified

7.5EPSS 0.007

CVE-2024-34109

Adobe Commerce | Improper Input Validation (CWE-20)

Published 2024-06-13 · Modified

7.2EPSS 0.014

CVE-2024-34110

RCE in the Adobe Commerce Webhook module through a legit webhook definition

Published 2024-06-13 · Modified

7.2EPSS 0.014

CVE-2023-26366

Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

Published 2023-10-13 · Modified

6.8EPSS 0.007

CVE-2021-39864

Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Published 2021-10-15 · Modified

6.5EPSS 0.016

CVE-2023-29289

Adobe Commerce XML Injection Security feature bypass

Published 2023-06-15 · Modified

6.5EPSS 0.009

CVE-2024-45132

Adobe Commerce | Incorrect Authorization (CWE-863)

Published 2024-10-10 · Modified

6.5EPSS 0.007

CVE-2024-45118

Adobe Commerce | Improper Access Control (CWE-284)

Published 2024-10-10 · Analyzed

6.5EPSS 0.006

CVE-2022-34257

Adobe Commerce Stored XSS Arbitrary code execution

Published 2022-08-16 · Modified

6.1EPSS 0.010

CVE-2024-45123

Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)

Published 2024-10-10 · Analyzed

6.1EPSS 0.005

CVE-2024-45128

Adobe Commerce | Incorrect Authorization (CWE-863)

Published 2024-10-10 · Modified

5.4EPSS 0.006

CVE-2024-45131

Adobe Commerce | Incorrect Authorization (CWE-863)

Published 2024-10-10 · Modified

5.4EPSS 0.005

CVE-2022-34259

Adobe Commerce Improper Access Control Security feature bypass

Published 2022-08-16 · Modified

5.3EPSS 0.016

CVE-2024-34106

Insecure Direct Object Reference - An attacker can able to erase the victim quote details

Published 2024-06-13 · Modified

5.3EPSS 0.008

Adobe Commerce 2.4.3

Security check