CVE-2025-27400

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.

• CWE-79

• https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea
• https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3
• https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668

Published

Feb 28, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27395A vulnerability has been identified in SCALANCE LPE9403 (6GK…6.5
• CVE-2025-27396A vulnerability has been identified in SCALANCE LPE9403 (6GK…8.8
• CVE-2025-27397A vulnerability has been identified in SCALANCE LPE9403 (6GK…5.1
• CVE-2025-27398A vulnerability has been identified in SCALANCE LPE9403 (6GK…2.7
• CVE-2025-27399Mastodon is a self-hosted, federated microblogging platform.…5.3
• CVE-2025-2740A vulnerability classified as critical has been found in PHP…7.3
• CVE-2025-27401Tuleap is an Open Source Suite to improve management of soft…4.6
• CVE-2025-27402Tuleap is an Open Source Suite to improve management of soft…4.6
• CVE-2025-27403Ratify is a verification engine as a binary executable and o…7.2
• CVE-2025-27404Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27405Icinga Web 2 is an open source monitoring web interface, fra…6.1
• CVE-2025-27406Icinga Reporting is the central component for reporting rela…7.6