Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVSS 9.8 · CriticalBuzz score 63.7KEV listed1 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 63.7

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 13.0 · KEV 25.0 · OTX 0.0 · PoC 5.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
13.0
4 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
5.0
1 repos · best confidence 0.99
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • Ticket to Shell: Exploiting PHP Filters and CNEXT in osTicket (CVE-2026-22200)Horizon3.ai

    CVE-2026-22200 is a severe vulnerability affecting osTicket, a popular open source helpdesk and ticketing system. This vulnerability enables anonymous attackers to read arbitrary files from the osTicket server, and in some cases execute arbitrary code. This issue is patched in osTicket 1.18.3 / 1.17.7.

    exploithorizon3.aiJan 22, 2026, 3:51 PM
  • Adobe Commerce and Magento users: Patch critical SessionReaper flaw nowCSO Online

    Adobe issued an emergency patch for one of the most severe vulnerabilities ever discovered in the Magento Open Source ecommerce platform and Adobe Commerce, its enterprise counterpart. The flaw allows unauthenticated attackers to hijack user accounts and, in some cases, execute arbitrary code on servers. Tracked as CVE-2025-54236 and dubbed SessionReaper by the security community, […]

    newswww.csoonline.comSep 10, 2025, 6:27 PM
  • Hackers steal sensitive customer data from thousands of online stores that use Adobe toolsCSO Online

    Distinct groups of cybercriminals have been exploiting the CosmicSting flaw in Adobe’s Commerce and Magento software to steal customers’ payment information. According to research by Sansec, miscreants have used the flaw, also tracked as CVE-2024-34102, to hack at least 5% of all Adobe Commerce and Magento stores this summer, breaking into thousands of brands using […]

    newswww.csoonline.comOct 4, 2024, 11:56 AM
  • Thousands of Adobe Commerce e-stores hacked by exploiting the CosmicSting bugSecurity Affairs

    Over 4,000 unpatched Adobe Commerce and Magento stores have been compromised by exploiting critical vulnerability CVE-2024-34102. Sansec researchers reported that multiple threat actors have exploited a critical Adobe Commerce vulnerability, tracked as CVE-2024-34102 (aka CosmicSting, CVSS score of 9.8), to compromise more than 4,000 e-stores over the past three months. The flaw is an Improper Restriction […]

    newssecurityaffairs.comOct 3, 2024, 2:36 PM
  • Adobe Commerce Flaw Exploited to Compromise Thousands of SitesSecurityWeek

    Over 4,000 Adobe Commerce and Magento stores unpatched against an exploited vulnerability have been compromised.

    newswww.securityweek.comOct 3, 2024, 11:24 AM
  • U.S. CISA adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe Commerce and Magento, SolarWinds Serv-U, and VMware vCenter Server bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the descriptions of the flaws added to the KEV catalog: […]

    newssecurityaffairs.comJul 21, 2024, 8:28 AM
  • Recent Adobe Commerce Vulnerability Exploited in WildSecurityWeek

    Adobe and CISA warn that a recent Adobe Commerce vulnerability has been exploited in the wild.

    newswww.securityweek.comJul 18, 2024, 1:38 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

1 repository references · best confidence 0.99 · max 0 stars

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence