CVE-2022-35698— Adobe Commerce Stored XSS Arbitrary code execution
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-35698
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adobe Commerce Stored XSS Arbitrary code execution
Source: NVD (National Vulnerability Database)
Vulnerability Description
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Commerce 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce存在跨站脚本漏洞。攻击者利用该漏洞可以执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Magento Commerce | unspecified ~ 2.4.5 | - |
II. Public POCs for CVE-2022-35698
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This repository contains potential security patches for the Magento APSB22-48 and CVE-2022-35698 security vulnerability | https://github.com/EmicoEcommerce/Magento-APSB22-48-Security-Patches | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-35698
请登录查看更多情报信息。
Same Patch Batch · Adobe · 2022-10-14 · 30 CVEs total
| CVE-2022-38418 | 9.8 CRITICAL | Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerabilit |
| CVE-2022-35710 | 9.8 CRITICAL | Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerabili |
| CVE-2022-35712 | 9.8 CRITICAL | Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2022-35711 | 9.8 CRITICAL | Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerabilit |
| CVE-2022-35690 | 9.8 CRITICAL | Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerabilit |
| CVE-2022-42339 | 7.8 HIGH | Adobe Acrobat Reader DC XFA Parsing Stack Overflow Remote Code Execution |
| CVE-2022-38444 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38450 | 7.8 HIGH | Adobe Acrobat Reader DC XFA Parsing Stack Overflow Remote Code Execution Vulnerability |
| CVE-2022-38448 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38442 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38446 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38447 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38445 | 7.8 HIGH | Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability |
| CVE-2022-38441 | 7.8 HIGH | Adobe Dimension GLB File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability |
| CVE-2022-38440 | 7.8 HIGH | Adobe Dimension SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability |
| CVE-2022-42341 | 7.5 HIGH | Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file syst |
| CVE-2022-38420 | 7.5 HIGH | Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service |
| CVE-2022-38422 | 7.5 HIGH | Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerabili |
| CVE-2022-38419 | 7.5 HIGH | Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read |
| CVE-2022-42340 | 7.5 HIGH | Adobe ColdFusion Improper Input Validation Arbitrary file system read |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Magento Commerce
- CVE-2023-38208
Validate Your Inputs | Improper Neutralization of Special El - CVE-2023-38209
Adobe Commerce Incorrect Authorization Security feature bypa - CVE-2023-29295
Insecure Direct Object Reference (IDOR) in Create Quote Func - CVE-2023-29297
Admin-to-admin stored XSS via cache poisoning - CVE-2023-29292
Server Side Request Forgery (SSRF) in FedEx carrier integrat
Same vendor: Adobe
- CVE-2026-34632
Photoshop Installer | CWE-427: Uncontrolled Search Path Elem - CVE-2026-27297
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27300
Adobe Framemaker | Access of Uninitialized Pointer (CWE-824) - CVE-2026-27296
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27290
Adobe Framemaker | Untrusted Search Path (CWE-426)
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2022-35698
No comments yet