CVE-2021-36020

highpriority · track · 40EPSS 0.027 · 86 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.71% (86th) EPSS

CVSS 7.5 · high

Is it mine?

20 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · psirt@adobe.comexploitability 3.9 · impact 4.2

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-91USprimaryCWE-91USCWE-91US

affected products (20)

Products and version ranges known to be affected.

Adobe Magento Commerce≤ unspecified ≤2.3.7enisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤Noneenisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤2.4.2-p1enisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤2.4.2enisa_euvdEU
Adobe Systems Inc. Magento Commerce≤ 2.4.3fstec_bduRU
Adobe Systems Inc. Magento Commerce≤ 2.3.7-p1fstec_bduRU
Adobe Systems Inc. Magento Commerce≤ 2.4.2-p2fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.3.7-p1fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.4.2-p2fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.4.3fstec_bduRU
adobe adobe commerce2.3.0 → 2.3.7nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe adobe commerce2.4.0 → 2.4.2nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe adobe commerce= 2.4.2nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe magento open source2.3.0 → 2.3.7nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobe magento open source2.4.0 → 2.4.2nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobe magento open source= 2.4.2nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
Packagist magento/community-editionall versionsosvUSpkg:composer/magento/community-edition
Packagist magento/community-edition< 2.3.7-p1osvUSpkg:composer/magento/community-edition
Packagist magento/community-edition2.4.2-p1 → 2.4.2-p2osvUSpkg:composer/magento/community-edition
Packagist magento/project-community-edition≤ 2.0.2osvUSpkg:composer/magento/project-community-edition

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-xvpx-6hh8-7h72Magento XML Injection vulnerability in the 'City' field2022-05-24ghsa · osvUS
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2021-09-01modified 2026-06-17

related (202)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2020-1147US	high7.8OT critical	94.0% (100th)	KEV	2020-07-14
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.…
CVE-2020-0646US	critical9.8OT critical	99.2% (100th)	KEV	2020-01-14
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
CVE-2023-46214US	high8.8	89.2% (100th)	Exploit	2023-11-16
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means…
CVE-2023-27253US	high8.8	89.5% (100th)	Exploit	2023-03-17
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the cont…
CVE-2008-0016US	high10.0	43.9% (99th)	Exploit	2008-09-24
Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a…

+197 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan