CVE-2023-36237

CVE-2023-36237 affects Bagisto prior to v1.5.1. The CSRF vulnerability allows an attacker to execute arbitrary code via a crafted HTML script, with root cause tied to insufficient request validation (e.g., REST-route validation in reported sources). The impact is described as arbitrary code execu...

CVE-2019-16403

In Webkul Bagisto before 0.1.5, a lack of proper access control allows a user to modify their own data and that of other customers (e.g., address, reviews, orders) via vulnerable customer-endpoints. The root cause is an authorization/control flaw on customer data modification endpoints (e.g., /cu...

CVE-2024-27499

CVE-2024-27499 (Bagisto v1.5.1) describes a Cross-Site Scripting (XSS) vulnerability arising from insufficient validation of user-uploaded PNG files in the product review option. Multiple sources (including Red Hat, Veracode, and OSV/GHSA entries) align on the issue being an XSS in Bagisto’s revi...

CVE-2019-14933

CVE-2019-14933 affects Bagisto 0.1.5, reporting a cross-site request forgery (CSRF) vulnerability on admin endpoints (under /admin). The primary details indicate that sensitive admin actions could be misused due to CSRF, with one source noting that GET methods were used on admin endpoints instead...

CVE-2023-36238

CVE-2023-36238 is an IDOR in Bagisto v1.5.1 that allows an attacker to obtain sensitive information by manipulating the invoice ID parameter. The vulnerability is rooted in insufficient validation of the invoice ID passed to the application, with Red Hat and Veracode sources describing the issue ...

CVE-2023-36236

CVE-2023-36236 affects Webkul Bagisto v1.5.0 and earlier. The vulnerability is Cross-Site Scripting (XSS) caused by improper validation of uploaded SVG files, allowing an attacker to execute arbitrary code via a crafted file upload. Impact is stated as arbitrary code execution under the described...

CVE-2025-40675

CVE-2025-40675 is a reflected XSS vulnerability reported in Bagisto v2.0.0. The issue arises from the use of the URL parameter query in the /search endpoint, enabling an attacker to inject and execute arbitrary JavaScript in a victim’s browser. The impact described across sources includes potenti...

CVE-2026-21449

CVE-2026-21449 affects Bagisto (pre-2.3.10). SSTI via first/last name supplied by a low-privilege user can lead to remote code execution. Version 2.3.10 includes a fix. Related advisories link to Bagisto security notes (SSTI via name fields; low-privilege access). If exploitable in practice, the ...

CVE-2025-62415

Bagisto v2.3.7 contains a Cross-Site Scripting (XSS) vulnerability in the TinyMCE image upload feature. An attacker with upload privileges (e.g., an admin) can upload a crafted HTML file containing embedded JavaScript, which executes in the context of the admin or viewer’s browser when opened. Th...

CVE-2023-33570

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Affected software: Bagisto 1.5.1; vulnerability type SSTI in template rendering. Underlying impact is described as HIGH for confidentiality, integrity, and availability; network attack vector with low privileges required and n...

CVE-2026-21450

Bagisto SSTI (server-side template injection) in the type parameter allows remote code execution. Affected versions are prior to 2.3.10; version 2.3.10 contains the fix. Exploitation details cited include an example payload accessing the admin view (type={{7*7}}), which can lead to RCE and other ...

CVE-2025-56426

Summary: CVE-2025-56426 affects WebKul Bagisto v2.3.6. The issue resides in the Cart/Checkout API’s price calculation logic, where quantity inputs are not properly validated, enabling remote code execution. All sources consistently describe a vulnerability that could be exploited via the Cart/Che...

CVE-2026-21447

Bagisto (Laravel eCommerce) prior to version 2.3.10 is affected by an Insecure Direct Object Reference (IDOR) in the customer order reorder function. The root cause is that OrderController::reorder retrieves orders by ID without verifying ownership, allowing any authenticated customer to add item...

CVE-2025-62418

Bagisto v2.3.7 contains an XSS vulnerability in TinyMCE image upload: uploading a crafted SVG with embedded JavaScript is possible by an admin or other privileged user, leading to code execution in the context of the viewer’s browser. The issue arises from SVGs being accepted without sanitization...

CVE-2026-21446

Summary (CVE-2026-21446) Bagisto (Laravel-based eCommerce) prior to 2.3.10 exposes installer API endpoints under /install/api/* that remain accessible after installation. The root cause is unauthenticated access to API routes (no auth/CSRF in /install/api/*), enabling an attacker to create admin ...

CVE-2025-62416

Bagisto v2.3.7 is affected by Server-Side Template Injection (SSTI) in product descriptions due to unsanitized user input being rendered by Laravel Blade. With product-creation privileges, an attacker can inject template expressions that the backend evaluates, potentially enabling Remote Code Exe...

CVE-2026-21451

Bagisto’s CMS page editor contains a stored XSS vulnerability in versions prior to 2.3.10. The issue arises because server-side sanitization is insufficient and the UI-level filter can be bypassed by tampering the raw HTTP POST payload, allowing arbitrary JavaScript to be stored and executed when...

CVE-2025-62414

Bagisto v2.3.7 contains a Cross-Site Scripting (XSS) vulnerability in the admin "Create New Customer" form. The issue arises from insufficient sanitization/escaping of input fields, allowing injected JavaScript to execute in an admin or viewer’s browser when customer data is displayed. The vulner...

CVE-2026-21448

Bagisto (Webkul Bagisto) is an open-source Laravel e-commerce platform. CVE-2026-21448 affects versions prior to 2.3.10 and is caused by a server-side template injection in the add-address step during checkout, which can lead to remote code execution. A patch is available in version 2.3.10. Some ...

CVE-2025-60880

Bagisto 2.3.6 admin panel product creation path is affected by an authenticated stored XSS via a crafted SVG file containing JavaScript. Exploitation requires an authenticated admin and can lead to in-browser arbitrary JS execution, with potential session hijacking or data theft. Affected compone...

CVE-2025-62417

Bagisto (open-source Laravel eCommerce platform) is affected by CVE-2025-62417 due to improper handling of leading spreadsheet formula characters (e.g., =, +, -, @) in CSV data, allowing formulas to be interpreted when a CSV is opened in spreadsheet software. This leads to potential data exfiltra...