[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":3,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":10,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":16,"all-banners":23,"vulnerability-29784":64},["Island",4],{"key":5,"params":6,"result":8},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":7},"{}",{"head":9},{},["Island",11],{"key":12,"params":13,"result":14},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":7},{"head":15},{},["Island",17],{"key":18,"params":19,"result":21},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":20},"{\"text-color\":\"gray\"}",{"head":22},{},[24,35,41,47,53,59],{"title":25,"slug":26,"text":27,"link":28,"external":29,"targets":30,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[31],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":36,"slug":37,"text":38,"link":28,"external":29,"targets":39,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[40],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":42,"slug":43,"text":44,"link":28,"external":29,"targets":45,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[46],"\u002Ffeatures\u002Fpentest-reporting",{"title":48,"slug":49,"text":50,"link":28,"external":29,"targets":51,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[52],"\u002Ffeatures\u002Fintegrations",{"title":54,"slug":55,"text":56,"link":28,"external":29,"targets":57,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[58],"\u002Fexploit-helpers\u002Fsniper",{"title":60,"slug":34,"text":61,"link":28,"external":29,"targets":62,"cta":32,"variant":33,"campaign_id":34},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[63],"\u002F",{"id":65,"detectable_with":66,"vuln_details":72,"vuln_id":96,"name":97,"published":98,"updated":98},29784,{"tool":67,"engine":70},{"id":68,"name":69},1,"Network Scanner",{"id":68,"name":71},"Sniper",{"id":65,"codename":73,"description":74,"severity":75,"risk_description":76,"public_description":77,"public_recommendation":78,"recommendation":79,"references":80,"cvssv3":84,"epss_score":85,"epss_percentile":86,"cve":87,"in_cisa_catalog":89,"date":90,"software_type":91,"vendor":92,"product":93,"ptt_exploit_capabilities":94},"StyleSmuggler","We found that the target is vulnerable to CVE-2026-75650 (\"StyleSmuggler\"), an unauthenticated remote code execution in Magento Open Source and Adobe Commerce. A PHP loader is first planted in a Magento error report via the \u002Fpaypal\u002Ftransparent\u002Fresponse\u002F endpoint, then admin email-preview directives are smuggled through a guest cart billing address. Triggering the failed-payment notification render reaches a gadget chain (ColumnSet -> Aws\\S3\\S3Client -> ArrayScanner) that includes and executes the poisoned report, allowing a remote unauthenticated attacker to run arbitrary PHP and OS commands on the server.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server in order to steal confidential customer and payment information, install ransomware or pivot to the internal network.","Magento Open Source and Adobe Commerce are vulnerable to CVE-2026-75650 (\"StyleSmuggler\"), an unauthenticated server-side template injection that leads to remote code execution. A remote attacker can execute arbitrary code on the store without any authentication.","Apply the Adobe hotfix VULN-39341 (APSB26-146) and rotate all secrets and credentials.","We recommend applying the Adobe hotfix VULN-39341 (APSB26-146) immediately and, because the store may already be compromised, rotating the encryption key, admin passwords, API\u002Fintegration tokens, payment gateway and database credentials.",[81,82,83],"https:\u002F\u002Fhelpx.adobe.com\u002Fsecurity\u002Fproducts\u002Fmagento\u002Fapsb26-146.html","https:\u002F\u002Fsansec.io\u002Fresearch\u002Fstylesmuggler-0day","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-75650",10,0.03949,0.90094,[88],"CVE-2026-75650",true,"2026-09-07T00:00:00Z","E-commerce Platform","Adobe","Magento \u002F Adobe Commerce",[95],"RCE","NETSCAN-SNIPER-CVE-2026-75650","Magento - Remote Code Execution","2026-09-29T00:00:00Z"]