Magento 2.3.5 Commerce Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*
part: a version: 2.3.5 update: -
| Vendor | Magento (aa019b60-1c50-5218-ad20-1f4a9a786d94) |
|---|---|
| Product | Magento (6f0f93c5-be7a-5b05-986f-1521453ea442) |
| Edition | * |
| Language | * |
| Software edition | commerce |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/firegento/magento |
purl2cpe | 2026-06-01 10:18:21.416347 |
pkg:magento/project-community-edition |
purl2cpe | 2026-06-01 10:18:21.416349 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-9692 |
vulnerable | 2026-06-08 05:28:02.609602 |
Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:48.000Z
Updated: 2024-08-04T10:34:39.935Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9691 |
vulnerable | 2026-06-08 05:28:02.608786 |
Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:52.000Z
Updated: 2024-08-04T10:34:39.934Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9690 |
vulnerable | 2026-06-08 05:28:02.603917 |
Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
Published: 2020-07-29T12:20:42.000Z
Updated: 2024-08-04T10:34:39.927Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-9689 |
vulnerable | 2026-06-08 05:28:02.600688 |
Details available
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Published: 2020-07-29T12:20:36.000Z
Updated: 2024-08-04T10:34:39.993Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24408 |
vulnerable | 2026-06-08 05:22:33.019030 |
Stored XSS in customer address upload feature
MEDIUM (6.1)
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
Published: 2020-10-16T14:03:11.096Z
Updated: 2024-09-17T03:02:26.471Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24407 |
vulnerable | 2026-06-08 05:22:33.017896 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24405 |
vulnerable | 2026-06-08 05:22:33.016144 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24404 |
vulnerable | 2026-06-08 05:22:33.015289 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24403 |
vulnerable | 2026-06-08 05:22:33.014530 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24402 |
vulnerable | 2026-06-08 05:22:33.013676 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24401 |
vulnerable | 2026-06-08 05:22:33.010094 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-24400 |
vulnerable | 2026-06-08 05:22:33.006820 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.