Login Request a demo
BA
Product
Bagisto
by Webkul · last CVE Sep 28, 2026
36
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities36In the news0Timeline
Severity mix
Critical 3High 10Medium 19Low 4
Severity
All severities36Critical3High10Medium19Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Bagisto to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-21450
9.8
1%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: before 2.3.10
CVE-2026-21448
9.8
1%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: before 2.3.10
CVE-2026-21446
9.8
1%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.0 before 2.3.10
CVE-2026-21449
8.8
1%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: before 2.3.10
CVE-2023-36237
8.8
0%
Feb 26
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script
Affected: before 1.5.1
CVE-2023-33570
8.8
1%
Jun 28
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI)
Affected: 1.5.1
CVE-2019-16403
8.8
1%
Sep 18
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers
Affected: before 0.1.5
CVE-2019-14933
8.8
1%
Aug 11
Bagisto 0.1.5 allows CSRF under /admin URIs
Affected: 0.1.5
CVE-2026-9506
8.7
1%
Jun 8
Path Traversal Vulnerability in Bagisto
Affected: version v2.4.1
CVE-2026-21451
8.4
1%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: before 2.3.10
CVE-2025-60880
8.3
0%
Oct 10
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious…
Affected: 2.3.6
CVE-2025-62417
7.8
0%
Oct 16
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.7
CVE-2026-21447
7.1
0%
Jan 2
Bagisto is an open source laravel eCommerce platform
Affected: before 2.3.10
CVE-2025-62416
6.8
0%
Oct 16
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.7
CVE-2025-56426
6.5
0%
Oct 9
An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate…
Affected: 2.3.6
CVE-2023-36238
6.5
1%
Mar 13
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter
Affected: 1.5.1
CVE-2024-27499
6.5
1%
Mar 1
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option
Affected: 1.5.1
CVE-2026-19994
6.3
0%
Aug 17
Webkul Bagisto Configuration Management execute authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2025-40675
6.1
0%
Jun 9
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0
Affected: 2.0.0 before 2.2.3
CVE-2026-60120
5.4
0%
Jul 9
Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
Affected: before 2.4.4
CVE-2025-62418
4.8
0%
Oct 16
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.7
CVE-2025-62415
4.8
0%
Oct 16
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.7
CVE-2025-62414
4.8
0%
Oct 16
Bagisto is an open source laravel eCommerce platform
Affected: 2.3.7
CVE-2023-36236
4.8
1%
Jan 16
Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad
Affected: through 1.5.0
CVE-2026-19997
4.7
0%
Aug 17
Webkul Bagisto Backend Sales RMA Endpoint requests authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19834
4.7
0%
Aug 14
Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-75082
4.3
0%
Aug 18
Webkul Bagisto Customer-Registration Notification Email register cross site scripting
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-75081
4.3
0%
Aug 17
Webkul Bagisto store behavioral workflow
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19996
4.3
0%
Aug 17
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19993
4.3
0%
Aug 17
Webkul Bagisto RMA State Validation update-status behavioral workflow
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19838
4.3
0%
Aug 14
Webkul Bagisto Backend Reporting Endpoint sales authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19836
4.3
0%
Aug 14
Webkul Bagisto Backend Customer Detail Feature view authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19835
3.8
0%
Aug 14
Webkul Bagisto Customer Item Deletion Endpoint access control
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19995
3.5
0%
Aug 17
Webkul Bagisto RMA Message send-message cross site scripting
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-101139
2.7
0%
Sep 28
Webkul Bagisto Invoice Mass Status Update state authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +5 more
CVE-2026-19837
2.7
0%
Aug 14
Webkul Bagisto Customer Search search information disclosure
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
Showing 36