Sign in
Deutsch English Español Polski
High

Magento Open Source allows Improper Neutralization of Special Elements Used

  • Disclosed: 15.06.2023
  • Updated: 11.10.2026 12:17

Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4
Composer package magento/project-community-edition <= 2.0.2 no fix
Magento (core) magento/community-edition >= 2.4.5-p1, < 2.4.5-p3, >= 2.4.4-p1, < 2.4.4-p4, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.4 2.4.5-p3, 2.4.4-p4

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-1336
Platform
Composer, Magento
Package
magento/community-edition, magento/project-community-edition
Disclosed
15.06.2023
Updated
11.10.2026 12:17

Sources and licenses

OSV / GitHub Advisory Database - GHSA-gfmm-ww6f-5mm5 - CC BY 4.0

Vulnerability history: magento/project-community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
11.2019 10.2025
Without a fix
160
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 48
  • Medium 77
  • Low 12

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 <= 2.0.2 no fix
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 <= 2.0.2 no fix
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.0.2 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 <= 2.0.2 no fix
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 <= 2.0.2 no fix
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 <= 2.0.2 no fix
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 <= 2.0.2 no fix
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 <= 2.0.2 no fix
  9. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 <= 2.0.2 no fix
  10. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 <= 2.0.2 no fix
  11. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 <= 2.0.2 no fix
  12. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 <= 2.0.2 no fix
  13. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 <= 2.0.2 no fix
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 <= 2.0.2 no fix
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 <= 2.0.2 no fix
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 <= 2.0.2 no fix
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 <= 2.0.2 no fix
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 <= 2.0.2 no fix
  19. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 <= 2.0.2 no fix
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 <= 2.0.2 no fix
  21. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 <= 2.0.2 no fix
  22. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 <= 2.0.2 no fix
  23. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 <= 2.0.2 no fix
  24. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 <= 2.0.2 no fix
  25. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 <= 2.0.2 no fix
  26. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 <= 2.0.2 no fix
  27. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 <= 2.0.2 no fix
  28. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 <= 2.0.2 no fix
  29. Magento Open Source allows Cross-Site Scripting (XSS)
    High · 9.1 CVE-2024-20719 <= 2.0.2 no fix
  30. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 <= 2.0.2 no fix
  31. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 <= 2.0.2 no fix
  32. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 <= 2.0.2 no fix
  33. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 <= 2.0.2 no fix
  34. Magento Open Source allows Improper Neutralization of Special Elements Used this entry
    High · 9.1 CVE-2023-29297 <= 2.0.2 no fix
  35. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 <= 2.0.2 no fix
  36. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 <= 2.0.2 no fix
  37. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 <= 2.0.2 no fix
  38. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 <= 2.0.2 no fix
  39. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 <= 2.0.2 no fix
  40. Magento has an XML Injection vulnerability
    Critical CVE-2021-36028 <= 2.0.2 no fix
Show more (20) Showing 40 of 72

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.