Exposición de Magento
CMS, Ecommerce435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2026-5603MEDIUMelgentos magento2-dev-mcp index.ts executeMagerun2Command os command injectionEPSS 0.9%CVE-2019-7864—An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9,EPSS 0.9%CVE-2023-29289MEDIUMAdobe Commerce XML Injection Security feature bypassEPSS 0.9%CVE-2019-8126—An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin EPSS 0.9%CVE-2026-47996MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.9%CVE-2019-8109—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user cEPSS 0.9%CVE-2023-38209MEDIUMAdobe Commerce Incorrect Authorization Security feature bypassEPSS 0.9%CVE-2019-8232—In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authentiEPSS 0.9%CVE-2019-7877—A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.EPSS 0.8%CVE-2019-7890—An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2EPSS 0.8%CVE-2021-28567MEDIUMMagento Commerce improper authorization allows an authenticated user to perform certain functions without permissionEPSS 0.8%CVE-2022-35692MEDIUMAdobe Commerce Improper Access Control Security feature bypassEPSS 0.8%CVE-2019-8123—An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, MagentoEPSS 0.8%CVE-2019-7889—An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.EPSS 0.8%CVE-2019-7904—Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 coulEPSS 0.8%CVE-2019-8090—An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An EPSS 0.8%CVE-2026-48411MEDIUMAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.8%CVE-2019-8140—An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated adEPSS 0.8%CVE-2019-8233—In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a reEPSS 0.7%CVE-2023-29294MEDIUMBypass Purchase Order Approval using Company User in Adobe Commerce B2BEPSS 0.7%