Aimeos

CVE-2025-66468 Dec 02, 19:15 PHP HIGH PATCH This Week

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.

CVE-2024-39319 Sep 26, 16:15 PHP MEDIUM PATCH This Month

aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-39325 Jul 02, 21:15 PHP MEDIUM PATCH This Month

aimeos/ai-controller-frontend is the Aimeos frontend controller. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-39324 Jul 02, 21:15 PHP LOW PATCH Monitor

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.

CVE-2021-28380 Mar 16, 20:15 PHP MEDIUM PATCH This Month

The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.