Exposure of Magento

CMS, Ecommerce
499
exposure score
32,588
sites use
4
exploited
39
critical

CVEs

361 results
CVE-2019-8139—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitraEPSS 0.6%CVE-2019-8129—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8146—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8092—A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An autheEPSS 0.6%CVE-2019-8128—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8142—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8138—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8132—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8115—A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An autheEPSS 0.6%CVE-2019-8148—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject aEPSS 0.6%CVE-2026-21290HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-21361HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2019-8227—In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitraryEPSS 0.5%CVE-2019-8228—in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitraryEPSS 0.5%CVE-2026-34652HIGHAdobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)EPSS 0.5%CVE-2026-48001LOWAdobe Commerce | Information Exposure (CWE-200)EPSS 0.5%CVE-2026-25525MEDIUMOpenMage LTS has Path Traversal Filter Bypass in Dataflow ModuleEPSS 0.5%CVE-2019-8155—Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacEPSS 0.5%CVE-2019-7865—A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.EPSS 0.5%CVE-2026-95630MEDIUMAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.5%