GCVE-110-NCSC-2025-322

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 16, 2025

Adobe Commerce versions 2.4.9-alpha2 and earlier are susceptible to a stored XSS vulnerability that enables high-privileged attackers to inject malicious scripts into form fields, executing them in victims' browsers.

Download JSON Open in Console

Weaknesses (CWE)

CWE-284Improper Access ControlCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-863Incorrect Authorization

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Adobe	vers:unknown/*	—	—

Aliases

CVE-2025-54263 CVE-2025-54264 CVE-2025-54265 CVE-2025-54266 CVE-2025-54267

References

advisory

Browse GCVE Records

74,557 records in the GCVE database · Updated July 23, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON