EUVD-2026-60559
GHSA-p2mh-m5f2-jjq2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges required at network-accessible registration endpoint; user interaction mandatory; integrity impact low with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AnalysisAI
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a publicly accessible Bagisto instance running version 2.4.4 or earlier with the customer self-registration feature enabled and active, which is a default-on capability for most e-commerce deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 is a technically accurate representation of this vulnerability's ceiling: user interaction is required (UI:P), there is no confidentiality impact (VC:N), and integrity impact is limited to the vulnerable system at low severity (VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a customer registration request to a public-facing Bagisto storefront, embedding a crafted script tag payload in the first_name or last_name field. When an administrator receives and opens the Customer-Registration Notification Email in an HTML-capable mail client, or reviews the registration in an interface that renders the stored input unsanitized, the payload executes within the administrator's browser session. … |
| Remediation | The vendor has acknowledged the reported issues and states that some have already been addressed through their internal security and development lifecycle, with remaining items planned for upcoming product releases; however, no specific patched version number has been confirmed at the time of this analysis, so patch status should be treated as partially in progress pending an official release announcement. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauth
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable f
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerabilit
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, o
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the we
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting maliciou
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. R
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged user
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today