Bagisto vulnerabilities

Products

• Bagisto 14

Newest

• bagisto Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting CVE-2026-121628 6.3 MediumNovember 3, 2026
• bagisto Bagisto has SSTI in parameter that can lead to RCE CVE-2026-21450 Fix available 7.3 HighJanuary 2, 2026
• bagisto Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21451 Fix available 5.2 MediumJanuary 2, 2026
• bagisto Bagisto has SSTI via first and last name from low-privilege user (not admin) CVE-2026-21449 Fix available 7.4 HighJanuary 2, 2026
• bagisto Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVE-2026-21448 Fix available 8.9 HighJanuary 2, 2026
• bagisto Bagisto has IDOR in Customer Order Reorder Functionality CVE-2026-21447 Fix available 7.1 HighJanuary 2, 2026
• bagisto Bagisto Missing Authentication on Installer API Endpoints CVE-2026-21446 Fix available 8.8 HighJanuary 2, 2026
• bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) CVE-2025-62418 Fix available 6.9 MediumOctober 16, 2025
• bagisto bagisto - Cross Site Scripting (XSS) in Create New Customer CVE-2025-62414 Fix available 6.9 MediumOctober 16, 2025
• bagisto bagisto - Server Side Template Injection (SSTI) in Product Description CVE-2025-62416 Fix available 5.1 MediumOctober 16, 2025
• bagisto bagisto - CSV Formula Injection in Create New Product CVE-2025-62417 Fix available 7.1 HighOctober 16, 2025
• bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) CVE-2025-62415 Fix available 6.9 MediumOctober 16, 2025
• bagisto Reflected Cross-Site Scripting (XSS) in Bagisto CVE-2025-40675 5.1 MediumJune 9, 2025
• bagisto Bagisto Cross-Site Request Forgery vulnerability CVE-2023-36237 Fix available 8.8 HighFebruary 26, 2024