Security
فارسی
All products

openmage/magento-lts

Composer · Package
26 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configsCVE-2024-41676 · GHSA-5VRP-638W-P8M2 openmage/magento-lts Composer Medium Fix reported
DoS vulnerability in MaliciousCode filterCVE-2023-23617 · GHSA-3P73-MM7V-4F6M openmage/magento-lts Composer Medium Fix reported
Fix for arbitrary file deletion in customer media allows for remote code executionCVE-2021-41143 · GHSA-5VPV-XMCJ-9Q85 openmage/magento-lts Composer High Fix reported
Fix for arbitrary command execution in custom layout update through blocksCVE-2021-39217 · GHSA-C9Q3-R4RV-MJM7 openmage/magento-lts Composer High Fix reported
Fix for authenticated remote code execution through layout updateCVE-2021-41144 · GHSA-5J2G-3PH4-RGVM openmage/magento-lts Composer High Fix reported
Backport for CVE-2021-21024 Blind SQLi from Magento 2CVE-2021-21427 · GHSA-FVRF-9428-527M openmage/magento-lts Composer Critical Fix reported
Layout XML Arbitrary Code Fix CVE-2021-32758 · GHSA-26RR-V2J2-25FH openmage/magento-lts Composer High Fix reported
Fixes a bug in Zend Framework's Stream HTTP WrapperCVE-2021-21426 · GHSA-M496-X567-F98C openmage/magento-lts Composer Critical Fix reported
DataFlow upload remote code execution vulnerabilityCVE-2021-41231 · GHSA-H632-P764-PJQM openmage/magento-lts Composer High Fix reported
magento-lts Reset Password not protected against well-timed CSRFCVE-2021-21395 · GHSA-R3C9-9J5Q-PWV4 openmage/magento-lts Composer Medium Fix reported
Data Flow Sanitation Issue Fix CVE-2021-32759 · GHSA-XM9F-VXMX-4M58 openmage/magento-lts Composer High Fix reported
RCE via PHP Object injection via SOAP RequestsCVE-2020-15244 · GHSA-JRGF-VFW2-HJ26 openmage/magento-lts Composer High Fix reported
Magento LTS: Reflected XSS - Import -> Data Flow (profiles) CVE-2026-42458 · GHSA-X8JV-Q8J2-487C openmage/magento-lts Composer Medium Fix reported
Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`CVE-2026-42207 · GHSA-QPGQ-5G92-J5Q8 openmage/magento-lts Composer Medium Fix reported
Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived InputsCVE-2026-42155 · GHSA-2CWR-GCF9-PVXR openmage/magento-lts Composer Critical Fix reported
OpenMage LTS: Cross-user wishlist import leads to private option & file disclosureCVE-2026-40098 · GHSA-665X-PPC4-685W openmage/magento-lts Composer Medium Fix reported
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code ExecutionCVE-2026-40488 · GHSA-3J5Q-7Q7H-2HHV openmage/magento-lts Composer High Fix reported
OpenMage LTS has a Path Traversal Filter Bypass in Dataflow ModuleCVE-2026-25525 · GHSA-6VQF-6FHM-7RC6 openmage/magento-lts Composer Medium Fix reported
OpenMage LTS: Phar Deserialization leads to Remote Code ExecutionCVE-2026-25524 · GHSA-FG79-CR9C-7369 openmage/magento-lts Composer High Fix reported
Magento LTS vulnerable to stored XSS in admin file formGHSA-GP6M-FQ6H-CJCX openmage/magento-lts Composer Medium Fix reported