Skip to content
OpenAdvisories

Package · Packagist

bagisto/bagisto

20 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-6744

    Bagisto Downloadable Link copy server-side request forgery

    A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and cou…

    bagisto/bagisto Packagist
  • Medium 5.2
    CVE-2026-21451

    Bagisto has HTML Filter Bypass that Enables Stored XSS

    Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering ca…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62415

    bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62418

    bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious …

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62414

    bagisto - Cross Site Scripting (XSS) in Create New Customer

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScr…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 5.1
    CVE-2025-62416

    bagisto - Server Side Template Injection (SSTI) in Product Description

    Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an …

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.5
    CVE-2023-36238

    Bagisto vulnerable to Insecure Direct Object Reference (IDOR)

    Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.

    bagisto/bagisto Packagist
  • Medium 6.5
    CVE-2024-27499

    Bagist Cross-site Scripting vulnerability

    Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.

    bagisto/bagisto Packagist
  • Medium 4.8
    CVE-2023-36236

    Cross-site Scripting in Bagisto

    Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.

    bagisto/bagisto Packagist