Skip to main content

Bagisto CVE-2019-14933

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2019-08-11 cve@mitre.org
CSRF Bagisto
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 11, 2019 - 21:15 nvd
HIGH 8.8

DescriptionNVD

Bagisto 0.1.5 allows CSRF under /admin URIs.

AnalysisAI

Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Affected products include: Webkul Bagisto.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Bagisto

View all
CVE-2026-21448 CRITICAL POC
9.8 Jan 02

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
CVE-2026-21446 CRITICAL POC
9.8 Jan 02

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
CVE-2026-21449 HIGH POC
8.8 Jan 02

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
CVE-2023-33570 HIGH POC
8.8 Jun 28

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
CVE-2019-16403 HIGH POC
8.8 Sep 18

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
CVE-2026-21451 HIGH POC
8.4 Jan 02

Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
CVE-2026-21447 HIGH POC
7.1 Jan 02

Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
CVE-2024-27499 MEDIUM POC
6.5 Mar 01

Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
CVE-2026-21450 CRITICAL
9.8 Jan 02

Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like

CVE-2026-9506 HIGH
8.7 Jun 08

Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
CVE-2025-40675 MEDIUM
6.1 Jun 09

A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an atta
CVE-2026-6744 LOW POC
2.1 Apr 21

Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticate

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2019-14933 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy