dweeves/magmi
Packagist6 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting dweeves/magmipage 1 of 1
- CVE-2014-8770NONECVSS 0.0EG 0.02014-11-13
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a…
- CVE-2015-2067NONECVSS 0.0EG 0.02015-02-24
vulnerable: 0.7.19, 0.7.19a, 0.7.20, 0.7.21
Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
- CVE-2015-2068NONECVSS 0.0EG 0.0✓ Fixed in 0.7.222015-02-24
vulnerable: 0.7.19, 0.7.19a, 0.7.20, 0.7.21
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUER…
- CVE-2017-7391MEDIUMCVSS 6.1EG 6.1✓ Fixed in 0.7.242017-04-01
vulnerable: 0.7.19, 0.7.19a, 0.7.20, 0.7.21, 0.7.22
A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execut…
- CVE-2020-5776HIGHCVSS 8.8EG 8.82020-09-01
vulnerable: 0.7.19 ... 0.7.24 (6 versions)
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
- CVE-2020-5777CRITICALCVSS 9.8EG 9.8✓ Fixed in 0.7.242020-09-01
vulnerable: 0.7.19, 0.7.19a, 0.7.20, 0.7.21, 0.7.22
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql set…
Check whether dweeves/magmi is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for dweeves/magmi CVEs against the assets you own.
Start Free Scan →