https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:43:59.413918+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-319034 EUVD-2026-319034 2026-10-02T10:43:59.416044+00:00 EUVD-2026-319034 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42458 fkie_cve-2026-42458 2026-10-02T10:43:59.416074+00:00

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.

 https://cve.radiocsirt.org/vuln/ghsa-x8jv-q8j2-487c GHSA-x8jv-q8j2-487c — Magento LTS: Reflected XSS - Import -> Data Flow (profiles) 2026-10-02T10:43:59.416105+00:00

Affected: Packagist: openmage/magento-lts

A reflected XSS vulnerability was found under admin panel -> System -> Import/Export -> Dataflow - Profiles.

## Steps to produce

+ Login to the admin panel

+ Go to the path `System -> Import/Export -> Dataflow - Profiles`

+ Select profile direction as `Import`.

+ Click on `Import Customers`

+ Upload the file.

File Link: [customer_20260212_204335.csv](https://github.com/user-attachments/files/25629638/customer_20260212_204335.csv)

+ Go back to `Run profile`.

+ Select the uploaded file and Click on `Run in Popup`.

+ One can see a URL like this

``` https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/import-20260215151125-1_customer_20260212_204335.csv/ ```

+ One can see the filename getting reflection in HTML tags.

+ Inject an HTML tag and observe.

``` https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/"><h3>hacked</h3>/ ```

<img width="1796" height="302" alt="image (3)" src="https://github.com/user-attachments/assets/502330b0-fa73-4b90-a81f-6216a98e474a" />

+ One can see the tag is getting executed.

+ Proceed for XSS.

``` https://demo-admin.openmage.org/index.php/admin/system_convert_gui/run/id/6/key/40dbbb2e93f45f0463c57ff733352f4f/files/%3CScRiPt%20%3Eprompt(document.cookie)%3C%2FScRiPt%3E ```

<img width="1670" height="562" alt="image (4)" src="https://github.com/user-attachments/assets/98a75081-fa8c-4483-9078-0…