Magmi Project maintains a single, modestly represented product used for data import and synchronization in Magento-based e-commerce environments. The product's vulnerabilities skew toward serious outcomes and frequently acquire public exploit code, reflecting its exposure in web-facing administrative contexts and the recurrence of input-handling and authentication weaknesses including cross-site scripting, cross-site request forgery, improper authentication, code injection, and path traversal. Defenders should treat this product as requiring careful access controls and timely patching, particularly where administrative interfaces are internet-reachable; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Magmi Project over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-2067MEDIUM Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via | Feb 24, 2015 | 5.0 | 54 | NO | YES |
CVE-2020-5777CRITICAL MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote at | Sep 1, 2020 | 9.8 | 53 | NO | YES |
CVE-2020-5776HIGH Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existi | Sep 1, 2020 | 8.8 | 40 | NO | YES |
CVE-2017-7391MEDIUM A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the 'magmi-git-maste | Apr 1, 2017 | 6.1 | 35 | NO | YES |
CVE-2015-2068MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML | Feb 24, 2015 | 4.3 | 34 | NO | YES |
CVE-2014-8770HIGH Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote a | Nov 13, 2014 | 9.0 | 34 | NO | YES |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Magmi Project.
Media articles that mention a CVE ID that affects a product developed by Magmi Project — matched by CVE ID, not by vendor name.