OpenMage kayıtları
openmage üreticisine ait 23 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %87
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')4
- CWE-502 Deserialization of Untrusted Data2
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWEBug bounty kapsamı
Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.
Tüm kayıtlar
23 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2021-21426İstismar yok | Fixes a bug in Zend Framework's Stream HTTP Wrapperopenmage · magento · CWE-502 | Kritik9,8 | — | %1,2 | 21 Nis 2021 |
35İzleyin | CVE-2021-41144İstismar yok | OpenMage LTS authenticated remote code execution through layout updateopenmage · magento · CWE-77 | Yüksek8,8 | — | %1,2 | 27 Oca 2023 |
34İzleyin | CVE-2026-40488İstismar yok | OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Executionopenmage · magento · CWE-434 | Yüksek8,7 | — | %1,0 | 20 Nis 2026 |
32İzleyin | CVE-2020-15151İstismar yok | Observable Timing Discrepancy in OpenMage LTSopenmage · openmage long term support · CWE-203 | Yüksek8,0 | — | %0,9 | 19 Ağu 2020 |
32İzleyin | CVE-2026-25524Kavram kanıtı | OpenMage LTS's Phar Deserialization leads to Remote Code Executionopenmage · magento · CWE-502 | Yüksek8,1 | — | %0,7 | 20 Nis 2026 |
30İzleyin | CVE-2023-41879İstismar yok | Magento LTS's guest order "protect code" can be brute-forced too easilyopenmage · magento · CWE-330 | Yüksek7,5 | — | %1,3 | 11 Eyl 2023 |
30İzleyin | CVE-2023-23617İstismar yok | OpenMage LTS has DoS vulnerability in MaliciousCode filteropenmage · magento · CWE-835 | Yüksek7,5 | — | %1,0 | 27 Oca 2023 |
29İzleyin | CVE-2020-26285İstismar yok | Widget instances allows a hacker to inject an executable file on the server on OpenMageopenmage · openmage · CWE-22 | Yüksek7,2 | — | %2,9 | 21 Oca 2021 |
29İzleyin | CVE-2020-26252İstismar yok | Layout XML RCE Vulnerability in OpenMageopenmage · openmage · CWE-22 | Yüksek7,2 | — | %2,1 | 20 Oca 2021 |
29İzleyin | CVE-2021-32758İstismar yok | Layout XML Arbitrary Code Fixopenmage · openmage · CWE-91 | Yüksek7,2 | — | %2,0 | 27 Ağu 2021 |
29İzleyin | CVE-2020-26295İstismar yok | CMS Editor code executionopenmage · openmage · CWE-22 | Yüksek7,2 | — | %1,8 | 21 Oca 2021 |
28İzleyin | CVE-2021-32759İstismar yok | Data Flow Sanitation Issue Fixopenmage · magento · CWE-20 | Yüksek7,2 | — | %1,3 | 27 Ağu 2021 |
28İzleyin | CVE-2021-39217İstismar yok | OpenMage LTS arbitrary command execution in custom layout update through blocksopenmage · magento · CWE-77 | Yüksek7,2 | — | %1,3 | 27 Oca 2023 |
28İzleyin | CVE-2021-41143İstismar yok | OpenMage LTS arbitrary file deletion in customer media allows for remote code executionopenmage · magento · CWE-77 | Yüksek7,2 | — | %1,3 | 27 Oca 2023 |
28İzleyin | CVE-2020-15244İstismar yok | In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can bopenmage · magento · CWE-74 | Yüksek7,2 | — | %1,3 | 21 Eki 2020 |
28İzleyin | CVE-2021-41231İstismar yok | OpenMage LTS DataFlow upload remote code execution vulnerabilityopenmage · magento · CWE-77 | Yüksek7,2 | — | %1,2 | 27 Oca 2023 |
28İzleyin | CVE-2021-21427İstismar yok | Backport for CVE-2021-21024 Blind SQLi from Magento 2openmage · magento · CWE-89 | Yüksek7,2 | — | %1,1 | 21 Nis 2021 |
21İzleyin | CVE-2026-25523İstismar yok | Magento's X-Original-Url header can expose admin urlopenmage · magento · CWE-200 | Orta5,3 | — | %0,4 | 4 Şub 2026 |
21İzleyin | CVE-2026-40098İstismar yok | OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variantopenmage · magento · CWE-862 | Orta5,3 | — | %0,2 | 20 Nis 2026 |
19İzleyin | CVE-2026-25525İstismar yok | OpenMage LTS has Path Traversal Filter Bypass in Dataflow Moduleopenmage · magento · CWE-22 | Orta4,9 | — | %0,7 | 20 Nis 2026 |
19İzleyin | CVE-2024-41676İstismar yok | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configsopenmage · magento · CWE-79 | Orta4,8 | — | %0,4 | 29 Tem 2024 |
18İzleyin | CVE-2025-64174İstismar yok | OpenMage is vulnerable to XSS in Admin Notificationsopenmage · magento · CWE-79 | Orta4,6 | — | %0,2 | 6 Kas 2025 |
17İzleyin | CVE-2021-21395İstismar yok | Magneto-lts vulnerable to Cross-Site Request Forgeryopenmage · magento · CWE-352 | Orta4,3 | — | %0,4 | 27 Oca 2023 |
- CVE-2021-2142639İzleyin
Fixes a bug in Zend Framework's Stream HTTP Wrapper
KritikCVSS 9,8İstismar yokEPSS %1openmage · magento21 Nis 2021
- CVE-2021-4114435İzleyin
OpenMage LTS authenticated remote code execution through layout update
YüksekCVSS 8,8İstismar yokEPSS %1openmage · magento27 Oca 2023
- CVE-2026-4048834İzleyin
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
YüksekCVSS 8,7İstismar yokEPSS %1openmage · magento20 Nis 2026
- CVE-2020-1515132İzleyin
Observable Timing Discrepancy in OpenMage LTS
YüksekCVSS 8,0İstismar yokEPSS %1openmage · openmage long term support19 Ağu 2020
- CVE-2026-2552432İzleyin
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
YüksekCVSS 8,1Kavram kanıtıEPSS %1openmage · magento20 Nis 2026
- CVE-2023-4187930İzleyin
Magento LTS's guest order "protect code" can be brute-forced too easily
YüksekCVSS 7,5İstismar yokEPSS %1openmage · magento11 Eyl 2023
- CVE-2023-2361730İzleyin
OpenMage LTS has DoS vulnerability in MaliciousCode filter
YüksekCVSS 7,5İstismar yokEPSS %1openmage · magento27 Oca 2023
- CVE-2020-2628529İzleyin
Widget instances allows a hacker to inject an executable file on the server on OpenMage
YüksekCVSS 7,2İstismar yokEPSS %3openmage · openmage21 Oca 2021
- CVE-2020-2625229İzleyin
Layout XML RCE Vulnerability in OpenMage
YüksekCVSS 7,2İstismar yokEPSS %2openmage · openmage20 Oca 2021
- CVE-2021-3275829İzleyin
Layout XML Arbitrary Code Fix
YüksekCVSS 7,2İstismar yokEPSS %2openmage · openmage27 Ağu 2021
- CVE-2020-2629529İzleyin
CMS Editor code execution
YüksekCVSS 7,2İstismar yokEPSS %2openmage · openmage21 Oca 2021
- CVE-2021-3275928İzleyin
Data Flow Sanitation Issue Fix
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento27 Ağu 2021
- CVE-2021-3921728İzleyin
OpenMage LTS arbitrary command execution in custom layout update through blocks
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento27 Oca 2023
- CVE-2021-4114328İzleyin
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento27 Oca 2023
- CVE-2020-1524428İzleyin
In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can b
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento21 Eki 2020
- CVE-2021-4123128İzleyin
OpenMage LTS DataFlow upload remote code execution vulnerability
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento27 Oca 2023
- CVE-2021-2142728İzleyin
Backport for CVE-2021-21024 Blind SQLi from Magento 2
YüksekCVSS 7,2İstismar yokEPSS %1openmage · magento21 Nis 2021
- CVE-2026-2552321İzleyin
Magento's X-Original-Url header can expose admin url
OrtaCVSS 5,3İstismar yokEPSS %0openmage · magento4 Şub 2026
- CVE-2026-4009821İzleyin
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
OrtaCVSS 5,3İstismar yokEPSS %0openmage · magento20 Nis 2026
- CVE-2026-2552519İzleyin
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
OrtaCVSS 4,9İstismar yokEPSS %1openmage · magento20 Nis 2026
- CVE-2024-4167619İzleyin
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
OrtaCVSS 4,8İstismar yokEPSS %0openmage · magento29 Tem 2024
- CVE-2025-6417418İzleyin
OpenMage is vulnerable to XSS in Admin Notifications
OrtaCVSS 4,6İstismar yokEPSS %0openmage · magento6 Kas 2025
- CVE-2021-2139517İzleyin
Magneto-lts vulnerable to Cross-Site Request Forgery
OrtaCVSS 4,3İstismar yokEPSS %0openmage · magento27 Oca 2023