Exposição de Magento
CMS, Ecommerce435
score de exposição
33.253
sites usam
3
em exploração
34
críticos
Análise Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2019-8144—A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payloEPSS 2.5%CVE-2019-8135—A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection thEPSS 2.5%CVE-2019-7930—A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticEPSS 2.4%CVE-2019-7932—A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prEPSS 2.4%CVE-2021-21020MEDIUMMagento Commerce Improper Access Control VulnerabilityEPSS 2.4%CVE-2021-36034CRITICALMagento Commerce Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.4%CVE-2021-36041CRITICALMagento Commerce Improper Input Validation Could Lead To Remote Code ExecutionEPSS 2.4%CVE-2019-8141—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An autEPSS 2.4%CVE-2023-38208CRITICALValidate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 2.3%CVE-2020-24401MEDIUMIncorrect permissions following the deletion of a user role or deactivation of a userEPSS 2.3%CVE-2020-24400HIGHSQL injection allows arbitrary read from databaseEPSS 2.3%CVE-2021-36030HIGHMagento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege EscalationEPSS 2.3%CVE-2022-34255HIGHAdobe Commerce Improper Access Control Privilege escalationEPSS 2.2%CVE-2021-36032HIGHMagento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege EscalationEPSS 2.2%CVE-2022-34254HIGHAdobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code executionEPSS 2.2%CVE-2021-21022MEDIUMMagento Commerce Incorrect permissions Could Lead To Unauthorized AccessEPSS 2.2%CVE-2019-7950—An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unaEPSS 2.2%CVE-2019-8149—Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. EPSS 2.1%CVE-2019-7903—A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authEPSS 2.1%CVE-2022-34256HIGHAdobe Commerce Improper Authorization Privilege escalationEPSS 2.1%