CVE-2015-2068

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

• CWE-79

• http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/35996Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/74879Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.htmlExploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/35996Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/74879Third Party Advisory, VDB Entry

Published

Feb 24, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2062Multiple SQL injection vulnerabilities in the Huge-IT Slider…7.2
• CVE-2015-2063Integer overflow in unace 1.2b allows remote attackers to ca…
• CVE-2015-2064Multiple cross-site scripting (XSS) vulnerabilities in DLGua…
• CVE-2015-2065SQL injection vulnerability in videogalleryrss.php in the Ap…
• CVE-2015-2066SQL injection vulnerability in DLGuard 4.5 allows remote att…
• CVE-2015-2067Directory traversal vulnerability in web/ajax_pluginconf.php…
• CVE-2015-2069Cross-site scripting (XSS) vulnerability in the WooCommerce …
• CVE-2015-2070SQL injection vulnerability in eTouch SamePage Enterprise Ed…
• CVE-2015-2071Directory traversal vulnerability in cm/newui/blog/export.js…
• CVE-2015-2072Multiple cross-site scripting (XSS) vulnerabilities in SAP H…
• CVE-2015-2073The File RepositoRy Server (FRS) CORBA listener in SAP Bussi…7.5
• CVE-2015-2074The File Repository Server (FRS) CORBA listener in SAP Bussi…7.5