Skip to content

Vendor

magmi project vulnerabilities

6 published CVES affecting magmi project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
1
High
2
Medium
3
Low
0
Unscored
0
CISA KEV
0
Atom feed of magmi project alerts

Products

Latest magmi project CVEs

Newest publication first

  1. CVE-2020-5776 Cross-Site Request Forgery in MAGMI

    Published
    HighCVSS 8.8 EPSS 14.7%

    Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.

  2. CVE-2020-5777 Authentication bypass in MAGMI

    Published
    CriticalCVSS 9.8 EPSS 23.3%

    MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is low...

  3. CVE-2017-7391 Magmi XSS Vulnerability

    Published
    MediumCVSS 6.1 EPSS 8.3%

    A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-master/magmi/web/ajax_gettime.php' URL. An attacker could execute arbitrary HTML and script code in a bro...

  4. CVE-2015-2067 MAGMI plugin for Magento Server Directory Traversal

    Published
    MediumCVSS 5.0 EPSS 38.5% Public exploit

    Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  5. CVE-2015-2068 MAGMI cross-site scripting (XSS)

    Published
    MediumCVSS 4.3 EPSS 14.0% Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

  6. CVE-2014-8770 MAGMI plugin for Magento Unsafe File Upload

    Published
    HighCVSS 9.0 EPSS 6.5% Public exploit

    Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.