#E-Commerce Security
All CosmicBytez Labs articles tagged #E-Commerce Security, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-103522: Thelia Store Banner Upload Remote Code Execution
Thelia's store banner upload feature trusts client-supplied MIME types, letting an admin-level attacker disguise a PHP webshell as an image.
- Security
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
CVE-2026-71362 (CVSS 9.1) lets unauthenticated attackers hijack Adobe Commerce and Magento customer sessions; CISA added it to KEV after active exploitation.
- News
Adobe Rushes Emergency Fix as Magento "StyleSmuggler" Zero-Day Backdoors Servers
A max-severity Magento/Adobe Commerce zero-day, StyleSmuggler, has been exploited since September 4 to plant Linux backdoors on live stores.
- Security
CVE-2026-75650: StyleSmuggler Zero-Day Grants Unauthenticated RCE in Adobe Commerce & Magento
A maximum-severity template injection flaw in Adobe Commerce and Magento is under active exploitation, letting attackers plant Linux backdoors pre-auth.
- News
'StyleSmuggler' Zero-Day in Magento and Adobe Commerce Is Actively Backdooring Live Stores
Sansec found an unpatched Magento/Adobe Commerce 0-day, StyleSmuggler, giving unauthenticated RCE via poisoned templates rendered in failed-payment emails.
- News
Hackers Exploit Critical Adobe Commerce Flaw to Hijack Customer Accounts
Active exploitation of CVE-2026-71362 in Adobe Commerce and Magento is underway, with attackers targeting customer account takeover on e-commerce storefronts.