Exposición de Magento

CMS, Ecommerce
435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday

Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.

CVEs

349 resultados
CVE-2019-8130—A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation EPSS 1.0%CVE-2026-48356CRITICALAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)EPSS 1.0%CVE-2019-8133—A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to genEPSS 1.0%CVE-2026-47992HIGHAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)EPSS 1.0%CVE-2023-23617MEDIUMOpenMage LTS has DoS vulnerability in MaliciousCode filterEPSS 1.0%CVE-2019-7855—A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticEPSS 1.0%CVE-2022-34257MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 1.0%CVE-2019-8124—An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior tEPSS 1.0%CVE-2023-22250MEDIUMAdobe Commerce Improper Access Control Security feature bypassEPSS 1.0%CVE-2023-29292MEDIUMServer Side Request Forgery (SSRF) in FedEx carrier integration configurationEPSS 1.0%CVE-2019-7888—An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An auEPSS 0.9%CVE-2020-15151HIGHObservable Timing Discrepancy in OpenMage LTSEPSS 0.9%CVE-2023-22247HIGHAdobe Commerce XML Injection Arbitrary file system readEPSS 0.9%CVE-2019-7899—Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.EPSS 0.9%CVE-2019-7852—A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for EPSS 0.9%CVE-2019-7898—Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, MaEPSS 0.9%CVE-2019-8113—Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the cEPSS 0.9%CVE-2019-8143—A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with acceEPSS 0.9%CVE-2019-7872—An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prioEPSS 0.9%CVE-2019-8107—An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated useEPSS 0.9%