MAGMI cross-site scripting (XSS)

MEDIUM 4.3CVE-2015-2068 · GHSA-27v2-398x-f74x · Published 24/02/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
dweeves/magmi Packagist	`< 0.7.22`	`0.7.22`

Description

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-2068 · ADVISORY
dweeves/magmi-git · PACKAGE
packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html · WEB
exploit-db.com/exploits/35996 · WEB
securityfocus.com/bid/74879 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free