Threats tagged 'ghsa-7m2g-jc99-9vpj'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability in the Dataflow profile run page. This flaw allows unauthenticated attackers to inject malicious markup via the store, type, or attribute_set columns of an import file, which is then executed in the session of an administrator who imports the file.