Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Adobe Commerce — Vulnerabilities & Security Advisories 169

All 169 CVE vulnerabilities found in Adobe Commerce, with AI-generated Chinese analysis, references, and POCs.

Vendor: Adobe

CVE IDTitleCVSSSeverityPublished
CVE-2024-39398 OTP 2FA can be bruteforced CWE-307 7.4 High2024-08-14
CVE-2024-39407 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium2024-08-14
CVE-2024-39401 Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) CWE-78 8.4 High2024-08-14
CVE-2024-39397 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) CWE-434 9.0 Critical2024-08-14
CVE-2024-39411 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium2024-08-14
CVE-2024-39409 Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352) CWE-352 4.3 Medium2024-08-14
CVE-2024-39416 Unauthorized user can export Orders Sale Report CWE-285 4.3 Medium2024-08-14
CVE-2024-39414 Being able to import/export tax rates without proper privileges CWE-284 4.3 Medium2024-08-14
CVE-2024-39412 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium2024-08-14
CVE-2024-39406 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 6.8 Medium2024-08-14
CVE-2024-39402 Adobe Commerce | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) CWE-78 8.4 High2024-08-14
CVE-2024-39400 DOM XSS through integrations can impact other admins CWE-79 8.1 High2024-08-14
CVE-2024-39404 A user without Shop Policy Parameters section privilege can alter the shop policy parameters section CWE-285 4.3 Medium2024-08-14
CVE-2024-39405 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 4.3 Medium2024-08-14
CVE-2024-39415 An unauthorized user can export the Tax Sales Report CWE-285 4.3 Medium2024-08-14
CVE-2024-34106 Insecure Direct Object Reference - An attacker can able to erase the victim quote details CWE-863 5.3 Medium2024-06-13
CVE-2024-34109 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 7.2 High2024-06-13
CVE-2024-34103 Customer account takeover via web API call & subsequent password reset CWE-287 8.1 High2024-06-13
CVE-2024-34110 RCE in the Adobe Commerce Webhook module through a legit webhook definition CWE-434 7.2 High2024-06-13
CVE-2024-34111 SSRF in service connector CWE-918 6.5 Medium2024-06-13
CVE-2024-34105 Stored Cross Site Scripting in Order Comment CWE-79 4.8 Medium2024-06-13
CVE-2024-34107 Adobe Commerce | Improper Access Control (CWE-284) CWE-284 5.3 Medium2024-06-13
CVE-2024-34104 Adobe Commerce | Improper Authorization (CWE-285) CWE-285 8.2 High2024-06-13
CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access CWE-611 9.8 Critical2024-06-13
CVE-2024-34108 Large attack surface through legit webhook usage in Adobe Commerce CWE-20 9.1 Critical2024-06-13
CVE-2024-20758 Adobe Commerce | Improper Input Validation (CWE-20) CWE-20 9.0 Critical2024-04-10
CVE-2024-20759 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) CWE-79 8.1 High2024-04-10
CVE-2024-20716 Force high-usage of resources by generating unlimited coupons: Adobe Commerce CWE-400 4.9 Medium2024-02-15
CVE-2024-20717 Stored admin XSS via PayPal authentication certificate CWE-79 5.4 Medium2024-02-15
CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce CWE-352 4.3 Medium2024-02-15

All 169 known CVE vulnerabilities affecting Adobe Commerce with full Chinese analysis, references, and POCs where available.