Skip to content
OpenAdvisories

Vendor

bagisto

13 known vulnerabilities.

Products

bagisto 13
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.2
    CVE-2026-21451

    Bagisto has HTML Filter Bypass that Enables Stored XSS

    Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering ca…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62415

    bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62418

    bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious …

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 6.9
    CVE-2025-62414

    bagisto - Cross Site Scripting (XSS) in Create New Customer

    Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScr…

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 5.1
    CVE-2025-62416

    bagisto - Server Side Template Injection (SSTI) in Product Description

    Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an …

    bagisto bagisto bagisto/bagisto Packagist
  • Medium 5.1
    CVE-2025-40675

    Reflected Cross-Site Scripting (XSS) in Bagisto

    A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. Thi…

    bagisto bagisto