Evil-DB LogoEvil-DB
← All CVEs

CVE-2025-54236

critical · 9.1Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2025-10-24Remediation due 2025-11-14

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

9.1
CVSS
94.5%
EPSS (exploit prob.)
100th
EPSS percentile
2025-09-09
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-20

Affected products

VendorProductAffected versions
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.4
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.5
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6
adobecommerce2.4.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-54236