BA
Product
Bagisto
36
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 10Medium 19Low 4
Watch
Add Bagisto to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21449 | 8.8 | Jan 2 | Bagisto has SSTI via first and last name from low-privilege user (not admin) Affected: before 2.3.10 |
| CVE-2023-36237 | 8.8 | Feb 26 | Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script Affected: before 1.5.1 |
| CVE-2023-33570 | 8.8 | Jun 28 | Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI) Affected: 1.5.1 |
| CVE-2019-16403 | 8.8 | Sep 18 | In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers Affected: before 0.1.5 |
| CVE-2019-14933 | 8.8 | Aug 11 | Bagisto 0.1.5 allows CSRF under /admin URIs Affected: 0.1.5 |
| CVE-2026-9506 | 8.7 | Jun 8 | Path Traversal Vulnerability in Bagisto Affected: version v2.4.1 |
| CVE-2026-21451 | 8.4 | Jan 2 | Bagisto has HTML Filter Bypass that Enables Stored XSS Affected: before 2.3.10 |
| CVE-2025-60880 | 8.3 | Oct 10 | An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious… Affected: 2.3.6 |
| CVE-2025-62417 | 7.8 | Oct 16 | Bagisto is an open source laravel eCommerce platform Affected: 2.3.7 |
| CVE-2026-21447 | 7.1 | Jan 2 | Bagisto has IDOR in Customer Order Reorder Functionality Affected: before 2.3.10 |
Showing 10