Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Advisory: Adobe Commerce — helpx.adobe.com/security/products/magento/apsb25-71.html Clear all filters
TI-2025-31571 CVE-2025-49556 · GHSA-7hrj-3c9x-xv5h

Adobe Commerce | Incorrect Authorization (CWE-863)

Priority MEDIUM 40

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00662 Published 2025-08-12 Fixed in 2.4.9-alpha2, 2.4.8-p2 +3 CWE-863
TI-2025-31572 CVE-2025-49557 · GHSA-8mq8-c243-2335

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Priority MEDIUM 41

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00701 Published 2025-08-12 Fixed in 2.4.4-p15, 2.4.5-p14 +2 CWE-79
TI-2025-31573 CVE-2025-49558 · GHSA-wcmw-8xpp-rwfj

Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Priority LOW 29

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feat…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00454 Published 2025-08-12 Fixed in 2.4.9-alpha2, 2.4.8-p2 +3 CWE-367
TI-2025-31569 CVE-2025-49554 · GHSA-xgfm-992v-h2hr

Adobe Commerce | Improper Input Validation (CWE-20)

Priority MEDIUM 40

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00613 Published 2025-08-12 Fixed in 2.4.9-alpha2, 2.4.8-p2 +3 CWE-20
TI-2025-31574 CVE-2025-49559 · GHSA-h4f4-gv6h-x824

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Priority LOW 33

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that c…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0073 Published 2025-08-12 Fixed in 2.4.9-alpha2, 2.4.8-p2 +3 CWE-22
TI-2025-31570 CVE-2025-49555 · GHSA-5777-jj7p-mpqw

Adobe Commerce | Cross-Site Request Forgery (CSRF) (CWE-352)

Priority LOW 39

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in privilege escalation.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00963 Published 2025-08-12 Fixed in 2.4.9-alpha2, 2.4.8-p2 +3 CWE-352