270 matches found
GHSA-R9XJ-MVQF-JM7W bagisto has Cross Site Scripting (XSS) in Create New Customer
Summary In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to reflected / stored Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later...
GHSA-JQRP-58FV-W8CQ bagisto has CSV Formula Injection in Create New Product
Summary When product data that begins with a spreadsheet formula character for example =, +, -, or @ is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field e.g.,...
CVE-2025-62414
Bagisto v2.3.7 contains a Cross-Site Scripting (XSS) vulnerability in the admin "Create New Customer" form. The issue arises from insufficient sanitization/escaping of input fields, allowing injected JavaScript to execute in an admin or viewer’s browser when customer data is displayed. The vulner...
CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...
CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...
CVE-2025-62414 bagisto - Cross Site Scripting (XSS) in Create New Customer
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...
CVE-2025-62417
Bagisto (open-source Laravel eCommerce platform) is affected by CVE-2025-62417 due to improper handling of leading spreadsheet formula characters (e.g., =, +, -, @) in CSV data, allowing formulas to be interpreted when a CSV is opened in spreadsheet software. This leads to potential data exfiltra...
CVE-2025-62414: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...
Webkul Software Bagisto 安全漏洞
Webkul Software Bagisto is an open source e-commerce framework from Webkul Software, India. A security vulnerability exists in Webkul Software Bagisto version 2.3.7, which stems from insufficient filtering of certain input fields in the Create New Customer functionality, which could lead to a...
EUVD-2016-1714
Malware in sbrugna...
EUVD-2020-19210
Malware in sbrugna...
EUVD-2018-2197
Malware in sbrugna...
EUVD-2019-6076
Malware in sbrugna...
EUVD-2021-28057
Malicious code in bioql PyPI...
CVE-2025-10388
A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component Create New Course Basic Settings. Such manipulation of the argument Description leads to cross site scripting. The attack can be launched...
PT-2025-37398
Name of the Vulnerable Software and Affected Versions: Selleo Mentingo version 2025.08.27 Description: A cross-site scripting issue exists due to manipulation of the Description argument in the processing of the /api/course/enroll-course endpoint within the Create New Course Basic Settings...
CVE-2025-10388: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component Create New Course Basic Settings. Such manipulation of the argument Description leads to cross site scripting. The attack can be launched...
CVE-2022-22909
HotelDruid v3.0.3 was discovered to contain a remote code execution RCE vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module...