Magento 2.3.6 Commerce Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*
part: a version: 2.3.6 update: -
| Vendor | Magento (aa019b60-1c50-5218-ad20-1f4a9a786d94) |
|---|---|
| Product | Magento (6f0f93c5-be7a-5b05-986f-1521453ea442) |
| Edition | * |
| Language | * |
| Software edition | commerce |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/firegento/magento |
purl2cpe | 2026-06-01 10:18:21.416373 |
pkg:magento/project-community-edition |
purl2cpe | 2026-06-01 10:18:21.416375 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-28585 |
vulnerable | 2026-06-08 05:31:24.604951 |
Magento Commerce improper input validation in customer customer webapi
MEDIUM (5.3)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
Published: 2021-06-28T13:47:54.410Z
Updated: 2024-09-16T17:19:04.822Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28584 |
vulnerable | 2026-06-08 05:31:24.604002 |
Magento Commerce path traversal vulnerability in child theme store creation
MEDIUM (5.4)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published: 2021-06-28T13:49:14.173Z
Updated: 2024-09-16T17:43:34.490Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-28583 |
vulnerable | 2026-06-08 05:31:24.596948 |
Magento Commerce insecure storage of sensitive documentation
HIGH (7.5)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.
Published: 2021-06-28T13:47:40.431Z
Updated: 2024-09-17T03:28:26.746Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21032 |
vulnerable | 2026-06-08 05:29:11.213253 |
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:29:32.196Z
Updated: 2024-09-17T04:18:49.706Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21031 |
vulnerable | 2026-06-08 05:29:11.212506 |
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:28:06.757Z
Updated: 2024-09-16T20:11:40.639Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21030 |
vulnerable | 2026-06-08 05:29:11.197315 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21029 |
vulnerable | 2026-06-08 05:29:11.196708 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21027 |
vulnerable | 2026-06-08 05:29:11.195387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21026 |
vulnerable | 2026-06-08 05:29:11.194768 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21025 |
vulnerable | 2026-06-08 05:29:11.194146 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21024 |
vulnerable | 2026-06-08 05:29:11.193622 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21023 |
vulnerable | 2026-06-08 05:29:11.192968 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21022 |
vulnerable | 2026-06-08 05:29:11.192118 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21020 |
vulnerable | 2026-06-08 05:29:11.190672 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21019 |
vulnerable | 2026-06-08 05:29:11.190029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21018 |
vulnerable | 2026-06-08 05:29:11.189357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21016 |
vulnerable | 2026-06-08 05:29:11.181397 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21015 |
vulnerable | 2026-06-08 05:29:11.180750 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21014 |
vulnerable | 2026-06-08 05:29:11.175666 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.