Login Request a demo
BA
Product
bagisto
by bagisto · last CVE Jan 2, 2026
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 3High 4Medium 5Low 0
Severity
All severities12Critical3High4Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add bagisto to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-21450
9.8
1%
Jan 2
Bagisto has SSTI in parameter that can lead to RCE
Affected: < 2.3.10
CVE-2026-21448
9.8
1%
Jan 2
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
Affected: < 2.3.10
CVE-2026-21446
9.8
1%
Jan 2
Bagisto Missing Authentication on Installer API Endpoints
Affected: >= 2.3.0, < 2.3.10
CVE-2026-21449
8.8
1%
Jan 2
Bagisto has SSTI via first and last name from low-privilege user (not admin)
Affected: < 2.3.10
CVE-2026-21451
8.4
1%
Jan 2
Bagisto has HTML Filter Bypass that Enables Stored XSS
Affected: < 2.3.10
CVE-2025-62417
7.8
0%
Oct 16
bagisto - CSV Formula Injection in Create New Product
Affected: < 2.3.8
CVE-2026-21447
7.1
0%
Jan 2
Bagisto has IDOR in Customer Order Reorder Functionality
Affected: < 2.3.10
CVE-2025-62416
6.8
0%
Oct 16
bagisto - Server Side Template Injection (SSTI) in Product Description
Affected: < 2.3.8
CVE-2025-40675
6.1
0%
Jun 9
Reflected Cross-Site Scripting (XSS) in Bagisto
Affected: 2.2.2
CVE-2025-62415
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)
Affected: < 2.3.8
CVE-2025-62418
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
Affected: < 2.3.8
CVE-2025-62414
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in Create New Customer
Affected: < 2.3.8
Showing 12