[CRITICAL] Improper Authorization vulnerability in Magento and Adobe Commerce

PKSA-yyc4-y66r-jjjj CVE-2025-24434 GHSA-fppq-f2m6-xv5c

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento stored Cross-Site Scripting (XSS) vulnerability

PKSA-z2xt-wddc-4p24 CVE-2025-24438 GHSA-8884-7rm9-mrx4

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Business Logic Error vulnerability

PKSA-tvs5-ndw3-3gtb CVE-2025-24425 GHSA-6ff8-jrfg-43hh

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-9ydt-2mcr-32qb CVE-2025-24427 GHSA-v3hq-g424-5mgg

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento stored Cross-Site Scripting (XSS) vulnerability

PKSA-tpt2-8yg8-qn5g CVE-2025-24428 GHSA-mm87-rrqx-94cr

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Improper Access Control vulnerability

PKSA-ypn7-w7vg-dsq3 CVE-2025-24429 GHSA-656q-fx2w-8ccv

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

PKSA-8p2p-vnj4-yrk7 CVE-2025-24430 GHSA-6w27-c66f-gvhq

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

PKSA-1bhd-hgqf-cyxr CVE-2025-24432 GHSA-7jmr-43qj-pw47

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-y1b3-85dn-dn7m CVE-2025-24435 GHSA-82p4-55gj-956p

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-y865-mwrz-phms CVE-2025-24436 GHSA-ghpr-6qhr-rpp8

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-c2zm-21rv-25c6 CVE-2025-24437 GHSA-469f-wf4f-3jjv

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Adobe Commerce Path Traversal

PKSA-dh2d-5mwk-96tg CVE-2025-24406 GHSA-954p-ff72-327w

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Information Exposure vulnerability

PKSA-xr11-y3bp-dn74 CVE-2025-24408 GHSA-3cfg-w257-cgf8

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Adobe Commerce Improper Authorization vulnerability

PKSA-dc79-d7y1-hqyg CVE-2025-24409 GHSA-vw47-79jv-3598

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-45vf-bpkb-pjdf CVE-2025-24410 GHSA-gjxp-46rq-wg4q

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Improper Access Control vulnerability

PKSA-yzxf-m1fz-3vtv CVE-2025-24411 GHSA-36hw-x3cc-m258

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-gf1j-gp76-gfxd CVE-2025-24412 GHSA-m4rg-mpp2-97px

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-7y5d-fvj3-6td4 CVE-2025-24413 GHSA-xwgx-8v72-4j5j

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-9j9m-fy1m-zf94 CVE-2025-24414 GHSA-fhw6-3mj5-w9gv

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-5pvr-47mr-pm8m CVE-2025-24415 GHSA-gc27-rvvm-q77r

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-hvsj-kptj-27zf CVE-2025-24416 GHSA-rjjw-g6hw-7pc9

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Stored Cross-Site Scripting (XSS) Vulnerability

PKSA-mp6w-9p7n-6ssm CVE-2025-24417 GHSA-g3j6-9753-8mp2

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Incorrect Authorization vulnerability

PKSA-s18y-x3y8-m1x1 CVE-2025-24421 GHSA-v6r2-425c-hfrr

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control vulnerability

PKSA-951b-x3mq-6x75 CVE-2025-24424 GHSA-539v-w87w-w62c

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows Improper Input Validation

PKSA-wvp2-5kwd-g52c CVE-2024-20758 GHSA-wh4m-6rh3-p4rq

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Cross-Site Scripting (XSS)

PKSA-31mc-ry3y-ky5k CVE-2024-20759 GHSA-59vf-hjxc-f9c5

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows OS Command Injection

PKSA-pn4n-ncsn-pdpm CVE-2024-20720 GHSA-525f-pvj5-vqmq

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows Cross-Site Scripting (XSS)

PKSA-13kv-2zmp-2qfd CVE-2024-20719 GHSA-264g-f7v8-q5qq

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Cross-Site Request Forgery (CSRF)

PKSA-8z11-z9kc-6gmc CVE-2024-20718 GHSA-hqgj-4396-hmxv

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Uncontrolled Resource Consumption

PKSA-dqz5-4xcm-g2zn CVE-2024-20716 GHSA-c9h9-h5gf-885r

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Uncontrolled Resource Consumption

PKSA-rq6g-gs41-zrhx CVE-2023-38251 GHSA-7pfc-834q-h497

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows SQL Injection

PKSA-vjc5-g3tb-vz4s CVE-2023-38250 GHSA-h3g9-cwr6-hphx

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows SQL Injection

PKSA-qg8c-sscf-zdxj CVE-2023-38249 GHSA-rq36-9f5f-2gw7

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Server-Side Request Forgery (SSRF)

PKSA-f98b-p1g7-d3k1 CVE-2023-26366 GHSA-8jxc-5f94-22vh

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source has Improper Input Validation Vulnerability

PKSA-bxnr-t1zg-rw75 CVE-2023-26367 GHSA-9mx6-4gg4-85xj

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Incorrect Authorization

PKSA-t7gh-79wr-5532 CVE-2023-38218 GHSA-rpc7-gf58-v3x2

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source allows Cross-Site Scripting (XSS)

PKSA-wf47-mk9w-64bn CVE-2023-38219 GHSA-3j7w-jp46-9752

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Improper Authorization

PKSA-bjs7-4spx-mkj7 CVE-2023-38220 GHSA-grc6-r6f8-xj7c

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows SQL Injection

PKSA-397d-r1wd-gxct CVE-2023-38221 GHSA-ggr8-3hwx-4f2m

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source affected by Improper Input Validation

PKSA-7dkv-7f5x-vd4n CVE-2022-24093 GHSA-5xmp-7wg5-x68q

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Incorrect Authorization

PKSA-hf5g-nxyv-9rq1 CVE-2023-38209 GHSA-3vg2-v639-6ch9

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows Improper Neutralization of Special Elements Used

PKSA-2h91-x29g-knck CVE-2023-38208 GHSA-mxc9-g6m4-2v35

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source allows XML Injection

PKSA-w77r-d31j-s553 CVE-2023-38207 GHSA-rpv2-g4pc-wp72

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Server-Side Request Forgery (SSRF)

PKSA-nypk-79pn-d4d9 CVE-2023-29291 GHSA-5f79-vhr4-vw2r

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Server-Side Request Forgery (SSRF)

PKSA-q7vj-nkkk-2f4n CVE-2023-29292 GHSA-4588-7x48-jrgj

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Incorrect Authorization

PKSA-4sd4-zdhg-q6p3 CVE-2023-29290 GHSA-qw5m-vmp3-f553

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source affected by Improper Input Validation

PKSA-7g4s-7b1v-ncqf CVE-2023-29293 GHSA-66c9-xrwj-9xv6

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source has Business Logic Errors Vulnerability

PKSA-88j6-sqdg-73f7 CVE-2023-29294 GHSA-28vp-39rf-3q2j

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source allows Incorrect Authorization

PKSA-y2vf-pgxy-f96y CVE-2023-29295 GHSA-354h-fpmq-68v7

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento Open Source allows Incorrect Authorization

PKSA-t1pm-nxqg-x3sk CVE-2023-29296 GHSA-3qr4-w96f-672v

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows Improper Neutralization of Special Elements Used

PKSA-pry8-1m8v-12x9 CVE-2023-29297 GHSA-gfmm-ww6f-5mm5

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Incorrect Authorization

PKSA-fhd6-13sx-5c9s CVE-2023-29288 GHSA-f989-3fp9-q3r2

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows XML Injection

PKSA-3ctk-j6rb-p8sd CVE-2023-29289 GHSA-wh42-8r2w-873x

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Information Exposure

PKSA-szdb-9t2m-hxqf CVE-2023-29287 GHSA-85m4-g9vq-xpxj

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source affected by Improper Input Validation

PKSA-whgb-ymvs-9ndx CVE-2023-22248 GHSA-5jfg-phx7-7fxg

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Incorrect Authorization

PKSA-jd5x-4m6x-4vs6 CVE-2023-22251 GHSA-2wm7-mmgc-qxr3

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Improper Access Control

PKSA-7dmw-wjmr-z2g6 CVE-2023-22250 GHSA-4h7p-4vq8-g2gh

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows XML Injection

PKSA-p9r2-cr37-khfw CVE-2023-22247 GHSA-2444-8gj8-6fmx

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Improper Access Control

PKSA-f4cm-wnhb-z3r9 CVE-2022-35689 GHSA-5fxx-jwjm-x9hj

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)

PKSA-43r1-4qf6-jnjt CVE-2022-35698 GHSA-4vj2-426r-jm3g

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source has Improper Access Control vulnerability

PKSA-qzv8-1n8s-nwtw CVE-2022-35692 GHSA-gm4m-9rm8-7rxj

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Open Source allows Cross-Site Request Forgery (CSRF)

PKSA-f81b-kr8n-1cqx CVE-2021-39864 GHSA-94wq-87g6-8h77

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Authorization vulnerability in the customers module

PKSA-6s73-s4rz-4fyb CVE-2021-28567 GHSA-cc3w-r3w8-hfh7

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats

PKSA-1s1d-4jtm-mgtx CVE-2021-28583 GHSA-7gh6-f4jh-3crq

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies

PKSA-jcpc-gqzs-vckj CVE-2021-28556 GHSA-39ch-rg26-gmq5

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper input validation vulnerability

PKSA-kf59-4nmv-jgxn CVE-2021-28585 GHSA-c38m-9668-6j2w

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Path Traversal vulnerability

PKSA-wsvj-3mm9-cfsj CVE-2021-28584 GHSA-7gpv-xrjr-f5h4

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Insufficient Session Expiration

PKSA-zczy-vth9-dsr8 CVE-2021-21031 GHSA-4h3p-63x6-vwg2

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Insecure Direct Object Reference (IDOR) in the product module

PKSA-m69c-bhkr-wybc CVE-2021-21022 GHSA-8pfq-g48p-x7w8

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento stored cross-site scripting vulnerability in the admin console

PKSA-2j3k-3g44-cnjj CVE-2021-21023 GHSA-h5rm-m772-6qcx

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento improper authorization vulnerability in the integrations module

PKSA-4v3y-vz4c-v2jc CVE-2021-21026 GHSA-crjc-2v9m-8w7r

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento stored cross-site scripting (XSS) in the customer address upload feature

PKSA-sv5d-15yf-jkvt CVE-2021-21030 GHSA-6988-g89m-27vf

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Insufficient Session Expiration

PKSA-srzx-p6c6-js6b CVE-2021-21032 GHSA-4jfq-f8hc-775q

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API

PKSA-nr3b-gd6w-ssxv CVE-2021-21027 GHSA-h4xc-577p-hgj9

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento XPath Injection

PKSA-vf7x-93bd-9dxz CVE-2021-21025 GHSA-h437-qjj9-vmq4

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Improper Access Control

PKSA-g3cj-592k-1jnk CVE-2021-21020 GHSA-2j6v-829g-885q

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento vulnerable to a file upload restriction bypass

PKSA-9362-vs4v-j6vt CVE-2021-21014 GHSA-269w-pqc7-68q9

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento OS command injection via the WebAPI

PKSA-3x4h-dj99-1bb6 CVE-2021-21016 GHSA-792f-c8mp-2cr5

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento 2 Community Edition RCE via Unsafe File Upload

PKSA-5gcm-4f3h-ccq3 CVE-2020-24407 GHSA-7pxg-6p87-8c9v

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento 2 Community Edition Incorrect Authorization

PKSA-897p-xmvy-tt74 CVE-2020-24401 GHSA-f2g3-3c6q-4478

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento incorrect permissions vulnerability in the Integrations component

PKSA-k3wv-nm33-qyds CVE-2020-24402 GHSA-hvf5-4jr9-fghh

Affected version: <=2.0.2

Reported by:
GitHub

[LOW] Magento incorrect user permissions vulnerability within the Inventory component

PKSA-z7pr-jrtx-p1ns CVE-2020-24403 GHSA-39rw-4m66-82gf

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento DOM-based Cross-site scripting vulnerability

PKSA-hwcd-t2bm-dpxv CVE-2020-9691 GHSA-g7pc-799q-743f

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento path traversal vulnerability

PKSA-vn8z-wfpr-9z9r CVE-2020-9689 GHSA-fr6f-xmfx-rrpq

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento business logic error vulnerability

PKSA-mxvf-4dqk-jkm7 CVE-2020-9630 GHSA-5j4w-v87m-8r65

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento security mitigation bypass vulnerability

PKSA-rwgp-ksc5-wcwr CVE-2020-9632 GHSA-6w29-x5j4-qhrw

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento security mitigation bypass vulnerability

PKSA-kxq8-h6yb-km6x CVE-2020-9631 GHSA-gffx-9f36-r8wp

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento Signature verification bypass

PKSA-b4sj-b4fw-vq95 CVE-2020-9588 GHSA-j2r4-2cr6-h3r3

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Magento authorization bypass vulnerability

PKSA-xt9x-ch8p-mqqg CVE-2020-9587 GHSA-8wm7-h2qh-ff4c

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento Defense-in-depth security mitigation vulnerability

PKSA-7h8p-1s1w-tr6y CVE-2020-9585 GHSA-55gv-hfg3-hwjq

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento Stored cross-site scripting

PKSA-pn9b-bn7v-6qgq CVE-2020-9584 GHSA-45h4-6gcj-6hwv

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento command injection vulnerability

PKSA-z6wq-jnnt-bc5n CVE-2020-9583 GHSA-c55h-7q4j-g6rq

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento command injection vulnerability

PKSA-d3r6-279w-y1d1 CVE-2020-9582 GHSA-c3m4-hxv9-4mxj

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento stored cross-site scripting vulnerability

PKSA-85pv-nkv7-zjm3 CVE-2020-9581 GHSA-2w2x-7qgj-4x78

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento command injection vulnerability

PKSA-n1g6-9qfx-sxg9 CVE-2020-9576 GHSA-4f7x-gjqc-qqpg

Affected version: <=2.0.2

Reported by:
GitHub

[MEDIUM] Magento stored cross-site scripting vulnerability

PKSA-bk74-986b-ccds CVE-2020-9577 GHSA-689w-2f93-2x67

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento command injection vulnerability

PKSA-7t4x-z168-kw9z CVE-2020-9578 GHSA-724x-gqhv-9c5x

Affected version: <=2.0.2

Reported by:
GitHub

[CRITICAL] Magento Security mitigation bypass vulnerability

PKSA-fbhc-z78m-yk4d CVE-2020-9580 GHSA-j2jp-58gv-g2pg

Affected version: <=2.0.2

Reported by:
GitHub

[HIGH] Unauthenticated crypto and weak IV in Magento\Framework\Encryption

PKSA-whwg-zcv6-qs4x CVE-2016-6485 GHSA-h7qw-mxrm-c6h2

Affected version: >=2.0,<=2.0.2

Reported by:
GitHub