Components Vulnerabilities Pricing MCP

openmage/magento-lts v19.4.20 | Vulnerabil… | Sonatype Guide

magento-lts

v19.4.20

magento-lts v19.4.20

openmage

PublishedDec 1, 2022•Policy

compliance

composer Registry

Developer Trust Score

N/A

Recommended Version:x.y.zBest

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (0)

High (0)

Medium (12)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV Status

Published

5.3CVE-2026-25523

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.

PublishedFeb 4, 2026

4.8CVE-2025-64174

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.

PublishedNov 4, 2025

5.1CVE-2024-38356

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

6.1CVE-2020-23064

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-11023. Reason: This candidate is a duplicate of CVE-2020-11023. Notes: All CVE users should reference CVE-2020-11023 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

6.5sonatype-2023-0779

magento-lts - Regular expression Denial of Service (ReDoS)

PublishedFeb 3, 2023

4.3CVE-2021-21395

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

PublishedJan 27, 2023

6.1CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

6.1CVE-2020-11023EXPLOITED

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

6.1sonatype-2020-0187

jQuery - Cross-Site Scripting (XSS)

4.7sonatype-2019-0333

tinymce - Cross Site Scripting (XSS)

PublishedAug 1, 2019

6.1sonatype-2017-0506

browser-jquery - Cross Site Scripting (XSS)

6.5sonatype-2014-0026

jQuery - Cross-Site Scripting (XSS)

Published

Jun 20, 2024

Published

Jun 27, 2023

Published

Jul 29, 2022

PublishedApr 30, 2020

Apr 14, 2020

Published

Jun 26, 2018

Mar 28, 2017