CVE-2025-27400

LowCVSS 2.9/10Last modified Jun 17, 2026

Description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.

Metrics

CVSS 3.1 2.9/10CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-274014.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue hCVE-2025-274024.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on trackCVE-2025-274037.2Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admitsCVE-2025-274046.1Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 aCVE-2025-274056.1Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 aCVE-2025-274067.6Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vCVE-2025-274079.0graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14,CVE-2025-274084.8Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SCVE-2025-274097.5Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior toCVE-2025-274106.5PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversalCVE-2025-274115.4REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fCVE-2025-274126.1REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting