Security: craftcms/commerce
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
TOCTOU race condition with single-use discount couponGHSA-wjxr-5jcm-hjgj published
Jul 25, 2026 by angrybradModerate -
Partial Payment Amount Without Lower Bound ValidationGHSA-78vr-q6cf-c7p6 published
Jun 16, 2026 by angrybradLow -
Coupon Code Brute-Force via Rate Limit BypassGHSA-h5gm-x9wr-vhcm published
Jun 16, 2026 by angrybradModerate -
Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous paymentsGHSA-3vxg-x5f8-f5qf published
Apr 13, 2026 by angrybradLow -
SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetGHSA-875v-7m49-8x88 published
Apr 13, 2026 by angrybradHigh -
Commerce hasVariant/hasProduct Blind SQL InjectionGHSA-r54v-qq87-px5r published
Apr 13, 2026 by angrybradHigh -
Potential IDOR in Commerce cartsGHSA-vff3-pqq8-4cpq published
Mar 9, 2026 by angrybradModerate -
Stored XSS in Craft Commerce Order Details SlideoutGHSA-mj32-r678-7mvp published
Mar 9, 2026 by angrybradLow -
Stored XSS while updating Order Status from Orders TableGHSA-mqxf-2998-c6cp published
Mar 9, 2026 by angrybradLow -
SQL Injection in Commerce Purchasables Table SortingGHSA-j3x5-mghf-xvfw published
Mar 9, 2026 by angrybradHigh