Packagist (PHP)
magento/project-community-edition Security Analysis
magento/project-community-edition has 48 known security vulnerabilities in Packagist (PHP). Review the table below for affected and fixed versions. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
48 Vulnerabilities
Actively Exploited
CISA has confirmed this package has vulnerabilities under active exploitation. Prioritize updating immediately.
Is magento/project-community-edition in your project?
Check if you're affected by these 48 vulnerabilities.
48
Total
0
Critical
0
High
0
Medium
0
Low
Active Exploitation Warning
One or more vulnerabilities in this package are known to be actively exploited in the wild. Immediate action is recommended.
Vulnerabilities
48 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2025-54236 Magento Community Edition Improper Input Validation vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24434 Improper Authorization vulnerability in Magento and Adobe Commerce | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36028 Magento has an XML Injection vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36021 Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36023 Magento XML Injection vulnerability in the Widgets Update Layout | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36036 Magento improper access control vulnerability within Magento's Media Gallery Upload workflow | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9630 Magento business logic error vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9632 Magento security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9631 Magento security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9585 Magento Defense-in-depth security mitigation vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9580 Magento Security mitigation bypass vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36025 Magento is affected by an improper input validation vulnerability while saving a customer's details | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36040 Magento has a file extension restrictions bypass | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2021-36042 Magento executes code via the API File Option Upload Extension | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2020-9691 Magento DOM-based Cross-site scripting vulnerability | CRITICAL | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24438 Magento stored Cross-Site Scripting (XSS) vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24414 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24417 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24415 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24410 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24412 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24416 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24413 Magento Stored Cross-Site Scripting (XSS) Vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-49555 Magento Cross-Site Request Forgery (CSRF) vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2022-35698 Magento Open Source allows Stored Cross-Site Scripting (Stored XSS) | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-20758 Magento Open Source allows Improper Input Validation | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24409 Adobe Commerce Improper Authorization vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-20719 Magento Open Source allows Cross-Site Scripting (XSS) | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-20720 Magento Open Source allows OS Command Injection | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-24411 Magento Improper Access Control vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-49557 Magento Cross-site Scripting vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-39402 Magento OS Command ('OS Command Injection') vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-39401 Magento OS Command ('OS Command Injection') vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-54264 Magento vulnerable to stored Cross-Site Scripting (XSS) | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-54263 Magento provides incorrect authorization through a security feature bypass | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-43585 Magento Improper Authorization leading to security feature bypass | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38208 Magento Open Source allows Improper Neutralization of Special Elements Used | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-39400 Magento DOM-based Cross-Site Scripting (XSS) vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2025-49556 Magento has incorrect authorization issue that leads to arbitrary file system read | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-29297 Magento Open Source allows Improper Neutralization of Special Elements Used | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-39403 Magento Stored Cross-Site Scripting (XSS) vulnerability | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-39398 Magento does not properly restrict excessive authentication attempts | HIGH | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38218 Magento Open Source allows Incorrect Authorization | MEDIUM | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2024-20759 Magento Open Source allows Cross-Site Scripting (XSS) | MEDIUM | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38250 Magento Open Source allows SQL Injection | MEDIUM | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38249 Magento Open Source allows SQL Injection | MEDIUM | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38221 Magento Open Source allows SQL Injection | MEDIUM | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
| CVE-2023-38219 Magento Open Source allows Cross-Site Scripting (XSS) | LOW | 0.1.0-alpha100, 0.1.0-alpha101, 0.1.0-alpha102, 0.1.0-alpha103 (+49 more) | No fix available |
About This Data
Vulnerability data for magento/project-community-edition is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Packagist (PHP) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of magento/project-community-edition.
Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed