Exposición de Magento
CMS, Ecommerce435
score de exposición
33.253
sitios usan
3
en explotación
34
críticos
Análisis Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2019-8154—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user wEPSS 1.9%CVE-2019-8235—An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 vEPSS 1.9%CVE-2019-8119—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An autEPSS 1.9%CVE-2019-8114—A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2EPSS 1.9%CVE-2020-3758—Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulEPSS 1.8%CVE-2020-3715—Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulEPSS 1.8%CVE-2021-21026MEDIUMMagento Commerce Incorrect permissions Could Lead To Unauthorized AccessEPSS 1.8%CVE-2021-36037MEDIUMMagento Commerce Improper Authorization Vulnerability Could Lead To Information ExposureEPSS 1.8%CVE-2021-36038MEDIUMMagento Commerce Multishipping Module Improper Input Validation Could Lead To Information ExposureEPSS 1.8%CVE-2020-26295HIGHCMS Editor code executionEPSS 1.8%CVE-2021-28584MEDIUMMagento Commerce path traversal vulnerability in child theme store creationEPSS 1.8%CVE-2019-7892—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 1.8%CVE-2021-36039MEDIUMMagento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information DisclosureEPSS 1.7%CVE-2019-8125—A remote code execution vulnerability exists in Magento 1 prior to 1.9.x and 1.14.x. An authenticated admin user can modify configuration paEPSS 1.7%CVE-2019-8091—A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to acceEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2019-8156—A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authentEPSS 1.7%CVE-2019-8151—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user wEPSS 1.7%CVE-2020-24402MEDIUMIncorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST APIEPSS 1.7%CVE-2021-36026MEDIUMMagento Commerce Stored Cross-site Scripting VulnerabilityEPSS 1.7%