Exposure of Magento

CMS, Ecommerce
499
exposure score
32,588
sites use
4
exploited
39
critical

CVEs

361 results
CVE-2021-21030HIGHMagento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript ExecutionEPSS 5.9%CVE-2020-9576—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuEPSS 5.7%CVE-2020-9582—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuEPSS 5.7%CVE-2020-9578—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuEPSS 5.7%CVE-2020-9583—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vuEPSS 5.7%CVE-2026-53787CRITICALAmasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File UploadEPSS 5.6%CVE-2020-24407CRITICALArbitrary code execution via file import functionalityEPSS 5.3%CVE-2022-34253CRITICALAdobe Commerce XML Injection Arbitrary code executionEPSS 5.2%CVE-2021-21016CRITICALMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 5.1%CVE-2020-9580—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation EPSS 5.0%CVE-2020-9579—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a security mitigation EPSS 5.0%CVE-2020-9587—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an authorization bypasEPSS 5.0%CVE-2020-9585—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth secEPSS 4.9%CVE-2021-21014CRITICALMagento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code ExecutionEPSS 4.4%CVE-2021-21018CRITICALMagnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code ExecutionEPSS 4.2%CVE-2020-9689—Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to aEPSS 4.1%CVE-2021-21012MEDIUMMagento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information DisclosureEPSS 4.0%CVE-2020-9630—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a business logic errorEPSS 4.0%CVE-2020-9692—Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation couEPSS 3.8%CVE-2021-21019CRITICALMagento Commerce XML Injection Could Lead To Remote Code ExecutionEPSS 3.8%