Webkul Bagisto vulnerabilities

• webkul bagisto Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload CVE-2026-121733 2.1 LowNovember 3, 2026
• webkul bagisto Webkul Bagisto Invoice Mass Status Update state authorization CVE-2026-101139 5.1 MediumSeptember 28, 2026
• webkul bagisto Webkul Bagisto Customer-Registration Notification Email register cross site scripting CVE-2026-75082 5.3 MediumAugust 18, 2026
• webkul bagisto Webkul Bagisto store behavioral workflow CVE-2026-75081 5.3 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto Backend Sales RMA Endpoint requests authorization CVE-2026-19997 5.1 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management CVE-2026-19996 5.3 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto RMA Message send-message cross site scripting CVE-2026-19995 5.1 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto Configuration Management execute authorization CVE-2026-19994 5.3 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto RMA State Validation update-status behavioral workflow CVE-2026-19993 5.3 MediumAugust 17, 2026
• webkul bagisto Webkul Bagisto Backend Reporting Endpoint sales authorization CVE-2026-19838 5.3 MediumAugust 14, 2026
• webkul bagisto Webkul Bagisto Customer Search search information disclosure CVE-2026-19837 5.1 MediumAugust 14, 2026
• webkul bagisto Webkul Bagisto Backend Customer Detail Feature view authorization CVE-2026-19836 5.3 MediumAugust 14, 2026
• webkul bagisto Webkul Bagisto Customer Item Deletion Endpoint access control CVE-2026-19835 5.1 MediumAugust 14, 2026
• webkul bagisto Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization CVE-2026-19834 5.1 MediumAugust 14, 2026
• webkul bagisto Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php CVE-2026-60120 5.1 MediumJuly 9, 2026
• webkul bagisto Path Traversal Vulnerability in Bagisto CVE-2026-9506 8.7 HighJune 8, 2026
• bagisto Bagisto has SSTI in parameter that can lead to RCE CVE-2026-21450 Fix available 7.3 HighJanuary 2, 2026
• bagisto Bagisto has HTML Filter Bypass that Enables Stored XSS CVE-2026-21451 Fix available 5.2 MediumJanuary 2, 2026
• bagisto Bagisto has SSTI via first and last name from low-privilege user (not admin) CVE-2026-21449 Fix available 7.4 HighJanuary 2, 2026
• bagisto Bagisto has Normal & Blind SSTI from low-privilege user when ordering product CVE-2026-21448 Fix available 8.9 HighJanuary 2, 2026
• bagisto Bagisto has IDOR in Customer Order Reorder Functionality CVE-2026-21447 Fix available 7.1 HighJanuary 2, 2026
• bagisto Bagisto Missing Authentication on Installer API Endpoints CVE-2026-21446 Fix available 8.8 HighJanuary 2, 2026
• bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) CVE-2025-62418 Fix available 6.9 MediumOctober 16, 2025
• bagisto bagisto - Cross Site Scripting (XSS) in Create New Customer CVE-2025-62414 Fix available 6.9 MediumOctober 16, 2025
• bagisto bagisto - Server Side Template Injection (SSTI) in Product Description CVE-2025-62416 Fix available 5.1 MediumOctober 16, 2025
• bagisto bagisto - CSV Formula Injection in Create New Product CVE-2025-62417 Fix available 7.1 HighOctober 16, 2025
• bagisto bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) CVE-2025-62415 Fix available 6.9 MediumOctober 16, 2025
• webkul bagisto Bagisto is vulnerable to XSS through Admin Panel's product creation path CVE-2025-60880 Public exploitFix available 8.3 HighOctober 10, 2025
• webkul bagisto An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart... CVE-2025-56426 6.5 MediumOctober 9, 2025
• bagisto Reflected Cross-Site Scripting (XSS) in Bagisto CVE-2025-40675 5.1 MediumJune 9, 2025
• webkul bagisto Bagisto vulnerable to Insecure Direct Object Reference (IDOR) CVE-2023-36238 Fix available 6.5 MediumMarch 13, 2024
• webkul bagisto Bagist Cross-site Scripting vulnerability CVE-2024-27499 Fix available 6.5 MediumMarch 1, 2024
• bagisto Bagisto Cross-Site Request Forgery vulnerability CVE-2023-36237 Fix available 8.8 HighFebruary 26, 2024
• webkul bagisto Cross-site Scripting in Bagisto CVE-2023-36236 Fix available 4.8 MediumJanuary 16, 2024
• webkul bagisto Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). CVE-2023-33570 8.8 HighJune 28, 2023
• webkul bagisto Authorization Bypass Through User-Controlled Key in Bagisto CVE-2019-16403 Fix available 8.8 HighSeptember 18, 2019
• webkul bagisto Bagisto CSRF Vulnerability CVE-2019-14933 Fix available 8.8 HighAugust 11, 2019