Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read

Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The original image-cache route /cache/original/filename passes the user-supplied filename to getImagePath without any '..' filtering or realpath containment, allowing a remote unauthenticated...

CVE-2025-60880

CVE-2025-60880: Bagisto 관리자 패널의 저장형 크로스 사이트 스크립팅XSS 취약점 Bagisto 2.3.6 관리자 패널의 제품 생성 경로에 인증된 저장형 XSS 취약점이 존재하며, 공격자는 악성 JavaScript 코드가 포함된 조작된 SVG 파일을 업로드할 수 있습니다. 이 취약점은 인증된 관리자 사용자가 브라우저에서 임의의 JavaScript를 실행하는 데 악용될 수 있으며, 세션 하이재킹, 데이터 탈취 또는 무단 작업으로 이어질 수 있습니다. 취약점 개요 CVE ID : CVE-2025-60880 유형 ...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

EUVD-2026-88444

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139

A vulnerability exists in Webkul Bagisto up to version 2.4.6 within the Invoice Mass Status Update component. The issue impacts an unknown function of the file /admin/sales/invoices/mass-update/state, where performing a manipulation leads to missing authorization . This flaw can be exploited remo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

Information Exposure

Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Information Exposure in the add-to-cart API and the downloadabl...

CVE-2026-79411

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-79411: Improper Privilege Management

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2026-79409: Authorization Bypass Through User-Controlled Key

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

PT-2026-92387

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

CVE-2026-79410

Webkul Bagisto v2.4.9 is vulnerable to a vulnerability where improper validation of the quantity parameter in the add-to-cart path allows authenticated attackers to manipulate order totals. By providing a negative quantity , an attacker can reduce the total order amount below the legitimate price...

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components...

CVE-2026-79410: Improper Input Validation

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...