deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rhff-65hp-55rw
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento allows attackers to alter the price of items

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.
GitHub Security Advisory: GHSA-rhff-65hp-55rw
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento allows attackers to alter the price of items

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.
GitHub Security Advisory: GHSA-7w95-qwhh-q9p3
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento Path Traversal vulnerability via the `theme[preview_image]` parameter

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-7w95-qwhh-q9p3
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento Path Traversal vulnerability via the `theme[preview_image]` parameter

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-7w95-qwhh-q9p3
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento Path Traversal vulnerability via the `theme[preview_image]` parameter

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-7w95-qwhh-q9p3
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento Path Traversal vulnerability via the `theme[preview_image]` parameter

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-7w95-qwhh-q9p3
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Path Traversal vulnerability via the `theme[preview_image]` parameter

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-p746-qw73-qmmx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-p746-qw73-qmmx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento XML Injection vulnerability in the Widgets Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-p746-qw73-qmmx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-p746-qw73-qmmx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento XML Injection vulnerability in the Widgets Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-p746-qw73-qmmx
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-m8wx-whpp-q283
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-m8wx-whpp-q283
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-m8wx-whpp-q283
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-m8wx-whpp-q283
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-m8wx-whpp-q283
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-3x9x-vhqj-cv27
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-3x9x-vhqj-cv27
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-3x9x-vhqj-cv27
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-3x9x-vhqj-cv27
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-3x9x-vhqj-cv27
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-xvpx-6hh8-7h72
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the 'City' field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-xvpx-6hh8-7h72
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento XML Injection vulnerability in the 'City' field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-xvpx-6hh8-7h72
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the 'City' field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-xvpx-6hh8-7h72
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento XML Injection vulnerability in the 'City' field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-xvpx-6hh8-7h72
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the 'City' field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-8gfq-m4cf-w975
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability in the customer address upload feature

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-8gfq-m4cf-w975
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento stored cross-site scripting vulnerability in the customer address upload feature

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-8gfq-m4cf-w975
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability in the customer address upload feature

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-8gfq-m4cf-w975
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento stored cross-site scripting vulnerability in the customer address upload feature

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-8gfq-m4cf-w975
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability in the customer address upload feature

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-x2v2-2jhp-c5hv
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-x2v2-2jhp-c5hv
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento stored cross-site scripting vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-x2v2-2jhp-c5hv
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-x2v2-2jhp-c5hv
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento stored cross-site scripting vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-x2v2-2jhp-c5hv
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento stored cross-site scripting vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.