Skip to content
Threat Feed
Subscribe

Vendor

OpenMage

2 briefs RSS
high advisory

OpenMage LTS Remote Code Execution via File Upload Bypass

OpenMage LTS is vulnerable to remote code execution due to an incomplete file upload blocklist, allowing attackers to upload PHP-executable files and execute arbitrary code on the server.

OpenMage LTS openmage rce file-upload php
2r 1t
critical advisory

OpenMage LTS Weak API Session ID Vulnerability Leads to Session Hijacking

OpenMage LTS version 20.16.0 and earlier has a critical vulnerability in the XML-RPC/SOAP API session ID generation, which uses a predictable MD5 hash of time-derived inputs, allowing attackers to brute-force and hijack active API sessions for data exfiltration, order fraud, and supply chain manipulation.

magento-lts session hijacking API vulnerability brute-force attack
2r 1t 1i