Search: CVE-2025-54236

Adobe Commerce versions up to 2.4.4-p15 are affected by an improper input validation vulnerability (CWE-20) that allows an attacker to perform session takeover without user interaction. This vulnerability has a critical severity with a CVSS score of 9.1, impacting confidentiality and integrity. Exploitation is known in the wild. No patch or remediation details are provided in the available data.

A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.