Bagisto
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 0
en
Verify to analyze this security profile
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-60120Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php | Exploitation statusNot known exploited | FixYes | Affected productBagisto | Published07/09/2026 | SeverityMedium |
CVE-2026-21450Bagisto has SSTI in parameter that can lead to RCE | Exploitation statusNot known exploited | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityHigh |
CVE-2026-21451Bagisto has HTML Filter Bypass that Enables Stored XSS | Exploitation statusPublic exploit | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityMedium |
CVE-2026-21449Bagisto has SSTI via first and last name from low-privilege user (not admin) | Exploitation statusPublic exploit | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityHigh |
CVE-2026-21448Bagisto has Normal & Blind SSTI from low-privilege user when ordering product | Exploitation statusPublic exploit | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityHigh |
CVE-2026-21447Bagisto has IDOR in Customer Order Reorder Functionality | Exploitation statusPublic exploit | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityHigh |
CVE-2026-21446Bagisto Missing Authentication on Installer API Endpoints | Exploitation statusNot known exploited | FixNot confirmed | Affected productBagisto | Published01/02/2026 | SeverityHigh |
CVE-2025-62415bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) | Exploitation statusPublic exploit | FixYes | Affected productBagisto | Published10/16/2025 | SeverityMedium |
CVE-2025-62418bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) | Exploitation statusPublic exploit | FixYes | Affected productBagisto | Published10/16/2025 | SeverityMedium |
CVE-2025-62414bagisto - Cross Site Scripting (XSS) in Create New Customer | Exploitation statusPublic exploit | FixYes | Affected productBagisto | Published10/16/2025 | SeverityMedium |
CVE-2025-62416bagisto - Server Side Template Injection (SSTI) in Product Description | Exploitation statusPublic exploit | FixYes | Affected productBagisto | Published10/16/2025 | SeverityMedium |
CVE-2025-62417bagisto - CSV Formula Injection in Create New Product | Exploitation statusPublic exploit | FixYes | Affected productBagisto | Published10/16/2025 | SeverityHigh |
CVE-2025-40675Reflected Cross-Site Scripting (XSS) in Bagisto | Exploitation statusNot known exploited | FixNot confirmed | Affected productBagisto | Published06/09/2025 | SeverityMedium |