Bagisto CVE-2023-33570

HIGH

Code Injection (CWE-94)

2023-06-28 cve@mitre.org

RCE Code Injection Bagisto

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Jun 28, 2023 - 20:15 nvd

HIGH 8.8

DescriptionNVD

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).

AnalysisAI

Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Affected products include: Webkul Bagisto.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Bagisto

View all

CVE-2026-21448 CRITICAL Act Now POC

Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address

CVE-2026-21446 CRITICAL Act Now POC

Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth

CVE-2026-21449 HIGH This Week POC

Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f

CVE-2019-16403 HIGH This Week POC

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o

CVE-2019-14933 HIGH This Week POC

Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2026-21451 HIGH This Week POC

Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou

CVE-2026-21447 HIGH This Week POC

Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]

CVE-2024-27499 MEDIUM This Month POC

Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R

CVE-2026-21450 CRITICAL Act Now

Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like

CVE-2026-9506 HIGH This Week

Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we

CVE-2025-40675 MEDIUM This Month

A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an atta

CVE-2026-6744 LOW Monitor POC

Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticate

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

CVE-2025-32432 CRITICAL POC

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

Share

CVE-2023-33570 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy