BA
Vendor
bagisto
12
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-21450 | BA bagisto bagisto | 9.8 | Jan 2 | Bagisto has SSTI in parameter that can lead to RCE |
| CVE-2026-21451 | BA bagisto bagisto | 8.4 | Jan 2 | Bagisto has HTML Filter Bypass that Enables Stored XSS |
| CVE-2026-21449 | BA bagisto bagisto | 8.8 | Jan 2 | Bagisto has SSTI via first and last name from low-privilege user (not admin) |
| CVE-2026-21448 | BA bagisto bagisto | 9.8 | Jan 2 | Bagisto has Normal & Blind SSTI from low-privilege user when ordering product |
| CVE-2026-21447 | BA bagisto bagisto | 7.1 | Jan 2 | Bagisto has IDOR in Customer Order Reorder Functionality |
| CVE-2026-21446 | BA bagisto bagisto | 9.8 | Jan 2 | Bagisto Missing Authentication on Installer API Endpoints |
| CVE-2025-62415 | BA bagisto bagisto | 4.8 | Oct 16 | bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) |
| CVE-2025-62418 | BA bagisto bagisto | 4.8 | Oct 16 | bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) |
| CVE-2025-62414 | BA bagisto bagisto | 4.8 | Oct 16 | bagisto - Cross Site Scripting (XSS) in Create New Customer |
| CVE-2025-62416 | BA bagisto bagisto | 6.8 | Oct 16 | bagisto - Server Side Template Injection (SSTI) in Product Description |
| CVE-2025-62417 | BA bagisto bagisto | 7.8 | Oct 16 | bagisto - CSV Formula Injection in Create New Product |
| CVE-2025-40675 | BA Bagisto Bagisto | 6.1 | Jun 9 | Reflected Cross-Site Scripting (XSS) in Bagisto |