Mirasvit vulnerabilities

Products

• helpdesk mx 2
• full page cache warmer 1
• Full Page Cache Warmer for Magento 2 1

Latest Mirasvit CVEs

Newest publication first

1. CVE-2026-45247 Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

   Published 2026-05-26

   Critical·CVSS 9.3 EPSS 26.2% CISA KEV added 2026-06-03 Exploited in the wild

   Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit...

2. CVE-2017-14321 Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) custo...

   Published 2017-09-21

   Medium·CVSS 5.4 EPSS 0.60%

   Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.

3. CVE-2017-14320 Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files.

   Published 2017-09-21

   High·CVSS 8.0 EPSS 1.4%

   Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.