Magmi Project

Magmi

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2020-5776

  • EPSS 79.73%
  • Veröffentlicht 01.09.2020 21:15:12
  • Zuletzt bearbeitet 21.11.2024 05:34:34

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.

9.8

CVE-2020-5777

  • EPSS 91.47%
  • Veröffentlicht 01.09.2020 21:15:12
  • Zuletzt bearbeitet 21.11.2024 05:34:34

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_co...

6.1

CVE-2017-7391

  • EPSS 8.89%
  • Veröffentlicht 01.04.2017 02:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary...

4.3

CVE-2015-2068

Exploit
  • EPSS 5.41%
  • Veröffentlicht 24.02.2015 17:59:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to...

5

CVE-2015-2067

Exploit
  • EPSS 82.76%
  • Veröffentlicht 24.02.2015 17:59:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

9

CVE-2014-8770

Exploit
  • EPSS 26.13%
  • Veröffentlicht 13.11.2014 21:32:14
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file t...