Description

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.

Remediation

References

CVE-2016-4010

Related Vulnerabilities

WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (12.0.1)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-4790)

EspoCRM Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33740)

WordPress Plugin Yakadanda Google+ Hangout Events Cross-Site Scripting (0.3.7)

WordPress Plugin Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, Aweber-MailOptin Cross-Site Request Forgery (1.2.19.1)

Severity

Critical

Classification

CVE-2016-4010 CWE-138 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities