Lucene search
+L

344 matches found

NVD
NVD
added 2026/09/15 7:17 p.m.2 views

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

8.1CVSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.17 views

Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The original image-cache route /cache/original/filename passes the user-supplied filename to getImagePath without any '..' filtering or realpath containment, allowing a remote unauthenticated...

8.7CVSS5.8AI score0.01238EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/15 12:00 a.m.3 views

EUVD-2026-79299

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

6.5CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 12:00 a.m.3 views

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 12:00 a.m.4 views

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

SaveExploits0References1
CVE
CVE
added 2026/09/15 12:00 a.m.3 views

CVE-2026-79411

Webkul Bagisto 2.4.9 has an incorrect privilege assignment in its admin user-management component. The endpoint UserController::update() (route admin.settings.users.update) fails to verify that the acting user is authorized to grant the requested role, does not block self-role changes, and does n...

SaveExploits0References1
CVE
CVE
added 2026/09/15 12:00 a.m.5 views

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

8.1CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/15 12:00 a.m.3 views

CVE-2026-79409

Webkul Bagisto 2.4.9 is affected by a sensitive information disclosure vulnerability in its add-to-cart API and downloadable fulfilment components . A remote attacker with low privileges can exploit this to obtain sensitive data, resulting in a high confidentiality impact with no integrity or ava...

6.5CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/15 12:00 a.m.3 views

EUVD-2026-79296

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

8.1CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/09 10:32 a.m.6 views

CVE-2025-60880

CVE-2025-60880: Bagisto 管理パネルにおける格納型クロスサイトスクリプティング(XSS) Bagisto 2.3.6 の管理パネルの製品作成パスに、認証済みの格納型 XSS 脆弱性が存在します。攻撃者は、悪意のある JavaScript コードを含む細工された SVG ファイルをアップロードできます。この脆弱性は、認証済みの管理者ユーザーによって悪用され、ブラウザ上で任意の JavaScript を実行させ、セッションハイジャック、データ窃取、または不正な操作につながる可能性があります。 脆弱性の概要 CVE ID : CVE-2025-60880 タイプ :...

8.3CVSS5.9AI score0.0041EPSS
SaveExploits1
EUVD
EUVD
added 2026/08/18 12:30 a.m.12 views

EUVD-2026-60558

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

5.3CVSS5.2AI score0.00271EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/18 12:16 a.m.21 views

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

5.3CVSS0.00331EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/18 12:16 a.m.12 views

CVE-2026-75081

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

5.3CVSS0.00271EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/18 12:00 a.m.40 views

CVE-2026-75082 Webkul Bagisto Customer-Registration Notification Email register cross site scripting

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

5.3CVSS0.00331EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/18 12:00 a.m.26 views

CVE-2026-75082

Bagisto up to 2.4.4 is vulnerable to reflected XSS via the first_name/last_name arguments in the Customer-Registration Notification Email component. The exploit has been published; the vendor confirms some items are fixed and remaining ones are planned for upcoming releases.

5.3CVSS3.9AI score0.00331EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/08/18 12:00 a.m.31 views

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

5.3CVSS3.8AI score0.00331EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/08/18 12:00 a.m.15 views

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

5.3CVSS4AI score0.00331EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.19 views

PT-2026-76885

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first name/last name causes basic cross site scripting. It is possible to...

5.3CVSS3.8AI score0.00331EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/17 11:45 p.m.39 views

CVE-2026-75081 Webkul Bagisto store behavioral workflow

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

5.3CVSS0.00271EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/08/17 11:45 p.m.29 views

CVE-2026-75081

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

5.3CVSS4.8AI score0.00271EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder