Exposição de Magento
CMS, Ecommerce435
score de exposição
33.253
sites usam
3
em exploração
34
críticos
Análise Vexday
Com 285 CVEs catalogadas e 2 entradas confirmadas no catálogo CISA KEV, o Magento apresenta taxa de exploração ativa acima da média geral do catálogo — 1,6 vez superior —, o que indica que vulnerabilidades nessa plataforma tendem a ser alvo real de agentes maliciosos com frequência desproporcional. O destaque de risco imediato é CVE-2022-24086, com EPSS de 0,992, sinalizando probabilidade extremamente elevada de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), e os 28 registros de severidade crítica, somados a 10 novas CVEs nos últimos 90 dias, reforçam a necessidade de gestão contínua de patches para ambientes que executam esta plataforma.
CVEs
349 resultadosCVE-2021-21031MEDIUMMagento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessEPSS 1.7%CVE-2021-21027MEDIUMMagento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data ModificationEPSS 1.7%CVE-2020-9690—Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitationEPSS 1.6%CVE-2020-24403LOWIncorrect permissions could lead to unauthorized modification of inventory source data via REST APIEPSS 1.6%CVE-2021-39864MEDIUMAdobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart AdditionEPSS 1.6%CVE-2021-21023MEDIUMMagento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code ExecutionEPSS 1.6%CVE-2019-7912—A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploEPSS 1.6%CVE-2022-34259MEDIUMAdobe Commerce Improper Access Control Security feature bypassEPSS 1.6%CVE-2020-24404LOWIncorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST APIEPSS 1.6%CVE-2021-28585MEDIUMMagento Commerce improper input validation in customer customer webapiEPSS 1.6%CVE-2021-21032MEDIUMMagento Commerce Failure To Invalidate User Session Could Lead To Unauthorized AccessEPSS 1.6%CVE-2020-24405MEDIUMIncorrect permissions in Inventory module could lead to unauthorized modification of inventory stock dataEPSS 1.5%CVE-2020-9577—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scEPSS 1.5%CVE-2020-9581—Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scEPSS 1.5%CVE-2026-48358CRITICALAdobe Commerce | Improper Encoding or Escaping of Output (CWE-116)EPSS 1.5%CVE-2019-8153—A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. SucEPSS 1.5%CVE-2019-7859—A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2EPSS 1.5%CVE-2019-7923—A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2EPSS 1.4%CVE-2019-7913—A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2EPSS 1.4%CVE-2019-7911—A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, MEPSS 1.4%