Vulnerabilities

TI-2026-17334 CVE-2026-21450 · GHSA-9hvg-qw5q-wqwp

Bagisto has SSTI in parameter that can lead to RCE

LOW 37

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.01362 Published 2026-01-02 Fixed in 2.3.10 CWE-1336

TI-2026-17335 CVE-2026-21451 · GHSA-2mwc-h2mg-v6p8

Bagisto has HTML Filter Bypass that Enables Stored XSS

MEDIUM 57

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0MEDIUM 5.2 Network High privileges No interaction EPSS 0.00557 Published 2026-01-02 Fixed in 2.3.10 CWE-79

TI-2026-17333 CVE-2026-21449 · GHSA-mqhg-v22x-pqj8

Bagisto has SSTI via first and last name from low-privilege user (not admin)

HIGH 68

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00504 Published 2026-01-02 Fixed in 2.3.10 CWE-1336

TI-2026-17332 CVE-2026-21448 · GHSA-5j4h-4f72-qpm6

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

HIGH 74

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00916 Published 2026-01-02 Fixed in 2.3.10 CWE-1336

TI-2026-17331 CVE-2026-21447 · GHSA-x5rw-qvvp-5cgm

Bagisto has IDOR in Customer Order Reorder Functionality

HIGH 70

Bagisto is an open source laravel eCommerce platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00304 Published 2026-01-02 Fixed in 2.3.10 CWE-284

TI-2026-17330 CVE-2026-21446 · GHSA-6h7w-v2xr-mqvw

Bagisto Missing Authentication on Installer API Endpoints

MEDIUM 47

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00634 Published 2026-01-02 Fixed in 2.3.10 CWE-306

TI-2025-38682 CVE-2025-62415 · GHSA-67px-r26w-598x

bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

MEDIUM 64

Bagisto is an open source laravel eCommerce platform.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0028 Published 2025-10-16 Fixed in 2.3.8 CWE-80

TI-2025-38685 CVE-2025-62418 · GHSA-fg89-g389-p346

bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

MEDIUM 64

Bagisto is an open source laravel eCommerce platform.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0028 Published 2025-10-16 Fixed in 2.3.8 CWE-80

TI-2025-38681 CVE-2025-62414 · GHSA-r9xj-mvqf-jm7w

bagisto - Cross Site Scripting (XSS) in Create New Customer

MEDIUM 64

Bagisto is an open source laravel eCommerce platform.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0028 Published 2025-10-16 Fixed in 2.3.8 CWE-80

TI-2025-38683 CVE-2025-62416 · GHSA-527q-4wqv-g9wj

bagisto - Server Side Template Injection (SSTI) in Product Description

MEDIUM 63

Bagisto is an open source laravel eCommerce platform.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00404 Published 2025-10-16 Fixed in 2.3.8 CWE-1336

TI-2025-38684 CVE-2025-62417 · GHSA-jqrp-58fv-w8cq

bagisto - CSV Formula Injection in Create New Product

HIGH 66

Bagisto is an open source laravel eCommerce platform.

CVSS 4.0HIGH 7.1 Local No auth User interaction EPSS 0.00392 Published 2025-10-16 Fixed in 2.3.8 CWE-1236

TI-2025-37847 CVE-2025-60880 · GHSA-29mf-w486-v3vc

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's…

HIGH 69

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code.

CVSS 3.1HIGH 8.3 Network High privileges User interaction EPSS 0.0041 Published 2025-10-10 Fixed in 2.3.7 CWE-79

TI-2025-35339 CVE-2025-56426 · GHSA-826h-vw99-v546

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via…

MEDIUM 64

An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00409 Published 2025-10-09 No fix listed CWE-77

TI-2025-27145 CVE-2025-40675 · GHSA-v7mq-jjjq-c7p3

Reflected Cross-Site Scripting (XSS) in Bagisto

LOW 23

A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00237 Published 2025-06-09 No fix listed CWE-79

TI-2023-18169 CVE-2023-36238 · GHSA-pmc7-hmmw-g96q

Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain…

LOW 30

Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00541 Published 2024-03-13 Fixed in 1.3.2 CWE-639

TI-2024-18286 CVE-2024-27499 · GHSA-w5mx-334j-6fwv

Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.

MEDIUM 62

Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00522 Published 2024-03-01 Fixed in 2.1.0 CWE-79

TI-2023-18168 CVE-2023-36237 · GHSA-7p7q-fjfw-v3gf

Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to…

MEDIUM 40

Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00393 Published 2024-02-26 Fixed in 1.3.2 CWE-352

TI-2023-18167 CVE-2023-36236 · GHSA-c962-g533-823f

Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an…

MEDIUM 63

Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0061 Published 2024-01-16 Fixed in 1.3.2 CWE-79

TI-2023-16589 CVE-2023-33570 · GHSA-w92h-gfcv-m7wv

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

HIGH 73

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0105 Published 2023-06-28 No fix listed CWE-94

TI-2019-12334 CVE-2019-16403 · GHSA-pwrf-q7h8-jjr7

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own…

MEDIUM 41

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01393 Published 2019-09-18 Fixed in 0.1.5 CWE-639

TI-2019-11132 CVE-2019-14933 · GHSA-pgwp-f3xh-m24g

Bagisto 0.1.5 allows CSRF under /admin URIs.

LOW 39

Bagisto 0.1.5 allows CSRF under /admin URIs.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00603 Published 2019-08-11 Fixed in 0.1.5 CWE-352

Vulnerabilities

Filters