CVE-2026-75082

Bagisto up to 2.4.4 is vulnerable to reflected XSS via the first_name/last_name arguments in the Customer-Registration Notification Email component. The exploit has been published; the vendor confirms some items are fixed and remaining ones are planned for upcoming releases.

CVE-2026-75082 Webkul Bagisto Customer-Registration Notification Email register cross site scripting

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

PT-2026-77633

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Customer Care versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Customer Care allows a high privileged attacker with network access via HTTP to compromise the syste...

PT-2026-76885

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first name/last name causes basic cross site scripting. It is possible to...

PT-2026-77773

Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Care...

CVE-2026-19996

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-19996

CVE-2026-19996 affects Webkul Bagisto (up to 2.4.4). The vulnerability resides in the Backend Customer Behavior Data Endpoint, specifically the /admin/customers area, where manipulation of the ID argument leads to improper privilege management. It can be exploited remotely; a public exploit exist...

EUVD-2026-60061

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

EUVD-2026-60056

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin (≤1.0.0) exposes the shopsmart_check_phone AJAX endpoint without authorization checks, allowing unauthenticated users to retrieve any customer's loyalty profile (name, email, account balance) by supplying a known phone number; CVSS 5.3 MEDIUM...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name,...

EUVD-2026-60055

A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/update-status of the component RMA State Validation. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-19933

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made availabl...

CVE-2026-19933

CVE-2026-19933 affects DefaultFuction Customer-Relationship-Management-In-C-Project 2.0, specifically the Customer Search Module. Affected component/function: Customer Search Module; root cause: manipulation of the function gets leads to a stack-based buffer overflow. Impact: enables remote attac...

EUVD-2026-59907

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made availabl...

CVE-2026-19933

A weakness has been identified in DefaultFuction Customer-Relationship-Management-In-C-Project 2.0. Impacted is the function gets of the component Customer Search Module. This manipulation causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made availabl...