Packagist (PHP)
magento/community-edition Security Analysis
magento/community-edition has 63 known security vulnerabilities in Packagist (PHP). Upgrade to version 2.4.9-alpha3 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
63 Vulnerabilities
Actively Exploited
CISA has confirmed this package has vulnerabilities under active exploitation. Prioritize updating immediately.
Recommended safe version: 2.4.9-alpha3
Upgrading to 2.4.9-alpha3 or later resolves all 63 known vulnerabilities in magento/community-edition. Run: composer require magento/community-edition:^2.4.9-alpha3
Is magento/community-edition in your project?
Check if you're affected and upgrade to 2.4.9-alpha3 to stay secure.
63
Total
0
Critical
0
High
0
Medium
0
Low
Active Exploitation Warning
One or more vulnerabilities in this package are known to be actively exploited in the wild. Immediate action is recommended.
Vulnerabilities
63 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2025-54236 Magento Community Edition Improper Input Validation vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+194 more) | No fix available |
| CVE-2024-34102 Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | CRITICAL | 2.4.4, 2.4.6-p1, 2.4.6-p2, 2.4.6-p3 (+157 more) | 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 |
| CVE-2022-24086 Magento improper input validation vulnerability | CRITICAL | 2.3.3-p1, 2.3.4, 2.3.4-p2, 2.3.5 (+16 more) | 2.3.7-p3, 2.4.3-p2 |
| CVE-2025-47110 Magneto contains stored XSS vulnerability | CRITICAL | 2.4.8, 2.4.8-beta1, 2.4.8-beta2, 2.4.7 (+183 more) | 2.4.8-p1, 2.4.7-p6, 2.4.5-p13 (+1 more) |
| CVE-2025-24434 Improper Authorization vulnerability in Magento and Adobe Commerce | CRITICAL | 2.4.8-beta1, 2.4.7, 2.4.7-beta1, 2.4.7-beta2 (+171 more) | 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9 (+2 more) |
| CVE-2021-36028 Magento has an XML Injection vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+120 more) | 2.3.7-p1, 2.4.2-p2 |
| CVE-2021-36021 Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+120 more) | 2.3.7-p1, 2.4.2-p2 |
| CVE-2021-36023 Magento XML Injection vulnerability in the Widgets Update Layout | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+120 more) | 2.3.7-p1, 2.4.2-p2 |
| CVE-2021-36036 Magento improper access control vulnerability within Magento's Media Gallery Upload workflow | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+120 more) | 2.3.7-p1, 2.4.2-p2 |
| CVE-2020-9630 Magento business logic error vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+111 more) | 2.3.4-p2 |
| CVE-2020-9632 Magento security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+111 more) | 2.3.4-p2 |
| CVE-2020-9631 Magento security mitigation bypass vulnerability | CRITICAL | 2.3.0, 2.3.1, 2.3.2, 2.3.2-p2 (+111 more) | 2.3.4-p2 |
| CVE-2020-9585 Magento Defense-in-depth security mitigation vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+111 more) | 2.3.4-p2 |
| CVE-2020-9580 Magento Security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+111 more) | 2.3.4-p2 |
| CVE-2019-7139 Magento 2 Community Edition SQLi Vulnerability | CRITICAL | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+25 more) | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2020-9579 Magento Security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+111 more) | 2.3.4-p2 |
| CVE-2024-34103 Magento Open Source Improper Authentication vulnerability | CRITICAL | 2.4.7, 2.4.6, 2.4.5, 2.4.4 (+157 more) | 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 |
| CVE-2019-8149 Magento Broken authentication and session managememt | CRITICAL | 2.2.0, 2.2.1, 2.2.2, 2.2.3 (+9 more) | 2.2.10, 2.3.2-p1 |
| CVE-2019-8158 Magento 2 Community Edition XML Injection | CRITICAL | 2.2.0, 2.2.1, 2.2.2, 2.2.3 (+9 more) | 2.2.10, 2.3.2-p2 |
| CVE-2019-8136 Magento 2 Community Edition Insecure Component | CRITICAL | 2.2.0, 2.2.1, 2.2.2, 2.2.3 (+9 more) | 2.2.10, 2.3.2-p1 |
| CVE-2021-36025 Magento is affected by an improper input validation vulnerability while saving a customer's details | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+120 more) | 2.3.7-p1, 2.4.2-p2 |
| CVE-2021-36040 Magento has a file extension restrictions bypass | CRITICAL | 2.4.2, 2.4.2-p1, 2.3.7, 0.1.0-alpha100 (+120 more) | 2.4.2-p2, 2.3.7-p1 |
| CVE-2021-36042 Magento executes code via the API File Option Upload Extension | CRITICAL | 2.4.2, 2.4.2-p1, 2.3.7, 0.1.0-alpha100 (+120 more) | 2.4.2-p2, 2.3.7-p1 |
| CVE-2020-9691 Magento DOM-based Cross-site scripting vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+114 more) | 2.3.5-p2 |
| CVE-2019-8144 Magento 2 Community Edition RCE Vulnerability | CRITICAL | 2.3.0, 2.3.1, 2.3.2 | 2.3.2-p1 |
| CVE-2025-24438 Magento stored Cross-Site Scripting (XSS) vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24414 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24417 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24415 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24410 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24412 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24416 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-24413 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-49555 Magento Cross-Site Request Forgery (CSRF) vulnerability | HIGH | 2.4.9-alpha1, 2.4.8, 2.4.8-beta1, 2.4.8-beta2 (+188 more) | 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7 (+2 more) |
| CVE-2022-35698 Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | HIGH | 2.4.4-p1, 2.4.4, 2.4.5, 2.4.3-p1 (+3 more) | No fix available |
| CVE-2024-20758 Magento Open Source allows Improper Input Validation | HIGH | 2.4.6, 2.4.5, 2.4.4, 2.4.7-beta1 (+19 more) | 2.4.7, 2.4.6-p5, 2.4.5-p7 (+1 more) |
| CVE-2025-24409 Adobe Commerce Improper Authorization vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2024-20719 Magento Open Source allows Cross-Site Scripting (XSS) | HIGH | 2.4.6, 2.4.5, 2.4.4, 2.4.6-p1 (+13 more) | 2.4.6-p4, 2.4.5-p6, 2.4.4-p7 |
| CVE-2024-20720 Magento Open Source allows OS Command Injection | HIGH | 2.4.6, 2.4.5, 2.4.4, 2.4.6-p1 (+13 more) | 2.4.6-p4, 2.4.5-p6, 2.4.4-p7 |
| CVE-2025-24411 Magento Improper Access Control vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+173 more) | 2.4.7-p4, 2.4.6-p9, 2.4.5-p11 (+1 more) |
| CVE-2025-49557 Magento Cross-site Scripting vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+178 more) | 2.4.4-p15, 2.4.5-p14, 2.4.6-p12 (+1 more) |
| CVE-2024-39402 Magento OS Command ('OS Command Injection') vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+27 more) | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 (+1 more) |
| CVE-2024-39401 Magento OS Command ('OS Command Injection') vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+27 more) | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 (+1 more) |
| CVE-2025-54264 Magento vulnerable to stored Cross-Site Scripting (XSS) | HIGH | 2.4.9-alpha1, 2.4.9-alpha2, 2.4.8, 2.4.8-beta1 (+193 more) | 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8 (+1 more) |
| CVE-2025-54263 Magento provides incorrect authorization through a security feature bypass | HIGH | 2.4.9-alpha1, 2.4.9-alpha2, 2.4.8, 2.4.8-beta1 (+193 more) | 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8 (+1 more) |
| CVE-2025-43585 Magento Improper Authorization leading to security feature bypass | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+181 more) | 2.4.7-p6, 2.4.6-p11, 2.4.5-p13 |
| CVE-2023-38208 Magento Open Source allows Improper Neutralization of Special Elements Used | HIGH | 2.4.6, 2.4.5, 2.4.4, 2.4.6-p1 (+7 more) | 2.4.6-p2, 2.4.5-p4, 2.4.4-p5 |
| CVE-2024-39400 Magento DOM-based Cross-Site Scripting (XSS) vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+27 more) | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 (+1 more) |
| CVE-2025-49556 Magento has incorrect authorization issue that leads to arbitrary file system read | HIGH | 2.4.9-alpha1, 2.4.8, 2.4.8-beta1, 2.4.8-beta2 (+188 more) | 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7 (+2 more) |
| CVE-2023-29297 Magento Open Source allows Improper Neutralization of Special Elements Used | HIGH | 2.4.6, 2.4.5, 2.4.4, 2.4.5-p1 (+4 more) | 2.4.5-p3, 2.4.4-p4 |
| CVE-2024-34104 Magento Open Source Improper Authorization vulnerability | HIGH | 2.4.7, 2.4.6, 2.4.5, 2.4.4 (+157 more) | 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 |
| CVE-2024-39403 Magento Stored Cross-Site Scripting (XSS) vulnerability | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+27 more) | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 (+1 more) |
| CVE-2024-39398 Magento does not properly restrict excessive authentication attempts | HIGH | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+27 more) | 2.4.7-p2, 2.4.6-p7, 2.4.5-p9 (+1 more) |
| CVE-2019-7876 Magento 2 Community Edition RCE Vulnerability | HIGH | 2.1.0, 2.1.0-rc1, 2.1.0-rc2, 2.1.0-rc3 (+28 more) | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2019-7865 Magento 2 Community Edition CSRF Vulnerability | HIGH | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+25 more) | 2.1.18, 2.2.9, 2.3.2 |
| CVE-2023-38218 Magento Open Source allows Incorrect Authorization | MEDIUM | 2.4.7-beta1, 2.4.6, 2.4.5, 2.4.4 (+11 more) | 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5 (+1 more) |
| CVE-2024-45116 Magento Open Source Cross-Site Scripting (XSS) vulnerability | MEDIUM | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+168 more) | 2.4.7-p3, 2.4.6-p8, 2.4.5-p10 (+1 more) |
| CVE-2024-20759 Magento Open Source allows Cross-Site Scripting (XSS) | MEDIUM | 2.4.6, 2.4.5, 2.4.4, 2.4.7-beta1 (+19 more) | 2.4.7, 2.4.6-p5, 2.4.5-p7 (+1 more) |
| CVE-2023-38250 Magento Open Source allows SQL Injection | MEDIUM | 2.4.7-beta1, 2.4.7, 2.4.6, 2.4.5 (+12 more) | 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5 (+1 more) |
| CVE-2023-38249 Magento Open Source allows SQL Injection | MEDIUM | 2.4.7-beta1, 2.4.7, 2.4.6, 2.4.5 (+12 more) | 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5 (+1 more) |
| CVE-2023-38221 Magento Open Source allows SQL Injection | MEDIUM | 2.4.7-beta1, 2.4.6, 2.4.5, 2.4.4 (+11 more) | 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5 (+1 more) |
| CVE-2024-45117 Magento Open Source Improper Input Validation vulnerability | MEDIUM | 2.4.7, 2.4.7-beta1, 2.4.7-beta2, 2.4.7-beta3 (+168 more) | 2.4.7-p3, 2.4.6-p8, 2.4.5-p10 (+1 more) |
| CVE-2023-38219 Magento Open Source allows Cross-Site Scripting (XSS) | LOW | 2.4.7-beta1, 2.4.6, 2.4.5, 2.4.4 (+11 more) | 2.4.7-beta2, 2.4.6-p3, 2.4.5-p5 (+1 more) |
About This Data
Vulnerability data for magento/community-edition is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Packagist (PHP) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of magento/community-edition.
Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed