Bagisto

13 CVEs across 1 Bagisto products. Browse Bagisto vulnerabilities, severities, and proof-of-concept exploits.

Bagisto products with known CVEs

ProductCVEs
Bagisto13
Bagisto CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-60120Medium5.42026-07-09Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute a…
CVE-2026-21451High8.42026-01-02Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CM…
CVE-2026-21450Critical9.82026-01-02Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can l…
CVE-2026-21449High8.82026-01-02Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name fr…
CVE-2026-21448Critical9.82026-01-02Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders…
CVE-2026-21447High7.12026-01-02Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder…
CVE-2026-21446Critical9.82026-01-02Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation i…
CVE-2025-62418Medium6.92025-10-16Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (…
CVE-2025-62417High7.82025-10-16Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepte…
CVE-2025-62416Medium5.12025-10-16Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being…
CVE-2025-62415Medium6.92025-10-16Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (…
CVE-2025-62414Medium6.92025-10-16Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scr…
CVE-2025-40675Medium6.12025-06-09A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the…