CVE-2021-36022

CVE-2021-36022 is an XML Injection vulnerability affecting Adobe Commerce and Magento Open Source versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). This high-severity vulnerability, rated 7.2 CVSS, allows an attacker with administrative privileges to achieve remote code execution by injecting a specially crafted script into the Widgets Update Layout. While there is no evidence of active exploitation or publicly available exploit code like Metasploit or ExploitDB entries, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.