Magento — PoC Archivehttps://poc.intelseclab.com/tags/magento/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Adobe Magento "SessionReaper" Unauthenticated File Upload / LFI (CVE-2025-54236)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-54236-magento-sessionreaper-lfi/Critical severity (CVSS 9.1) — web · CVE-2025-54236. Status: PoC. Affects: Adobe Commerce / Magento Open Source — customer/address_file/upload endpoint (dubbed "SessionReaper"). Tags: magento, adobe-commerce, sessionreaper, file-upload, lfi, customer-address, form-key, cwe-434, python.webCriticalmagentoadobe-commercesessionreaperfile-uploadlficustomer-addressform-keycwe-434pythonUnauthenticated RCE in Mirasvit Full Page Cache Warmer for Magento 2 (CVE-2026-45247)https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-45247-mirasvit-magento-cache-warmer-rce/Critical severity (CVSS 9.3) — web · CVE-2026-45247. Status: Weaponized. Affects: Mirasvit Full Page Cache Warmer extension for Magento 2. Tags: php-object-injection, insecure-deserialization, RCE, Magento, Mirasvit, e-commerce, cookie-based, unauthenticated, CISA-KEV, active-exploitation.webCriticalphp-object-injectioninsecure-deserializationRCEMagentoMirasvite-commercecookie-basedunauthenticatedCISA-KEVactive-exploitation