Exposición de Magento
CMS, Ecommerce435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2019-8146—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8145—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8138—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8120—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2EPSS 0.6%CVE-2019-8092—A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An autheEPSS 0.6%CVE-2019-8142—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentiEPSS 0.6%CVE-2019-8148—A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject aEPSS 0.6%CVE-2019-8115—A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An autheEPSS 0.6%CVE-2026-25524HIGHOpenMage LTS's Phar Deserialization leads to Remote Code ExecutionEPSS 0.5%CVE-2026-48414HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-21282MEDIUMAdobe Commerce | Improper Input Validation (CWE-20)EPSS 0.5%CVE-2019-8227—In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitraryEPSS 0.5%CVE-2019-8228—in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitraryEPSS 0.5%CVE-2026-34652HIGHAdobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)EPSS 0.5%CVE-2026-48001LOWAdobe Commerce | Information Exposure (CWE-200)EPSS 0.5%CVE-2026-25525MEDIUMOpenMage LTS has Path Traversal Filter Bypass in Dataflow ModuleEPSS 0.5%CVE-2019-8155—Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacEPSS 0.5%CVE-2019-7865—A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.EPSS 0.5%CVE-2026-48416HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.5%CVE-2026-77774HIGHAdobe Commerce | Incorrect Authorization (CWE-863)EPSS 0.5%