Bagisto
Monthly
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload/media-manager feature lets a back-office user with upload privileges plant an SVG containing embedded JavaScript that executes in another admin or editor's browser when the media is viewed. The vector is PR:H/UI:R (requires an authenticated privileged account and a victim who views the content), giving limited confidentiality and integrity impact within a changed scope. Public proof-of-concept detail accompanies the GitHub advisory and the vendor fixed the issue in 2.3.8; EPSS is low at roughly 0.28% and there is no CISA KEV entry, so this is a modest-severity, second-order XSS rather than a broadly exploited one.
CSV formula injection in Bagisto through 2.3.7 allows a user who can create or edit product data to store spreadsheet formulas in fields such as product name, which are then written unescaped into exported CSV files. When an administrator or other victim opens the export in Excel or similar software, the formula may be evaluated, enabling data exfiltration through functions such as WEBSERVICE or HYPERLINK and, in legacy or permissive spreadsheet environments, possible command execution. Publicly available exploit code exists, but exploitation requires a product-data write, a CSV export action, and a victim opening the file; there is no CISA KEV confirmation. The issue is fixed in 2.3.8.
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inject Blade template expressions through product descriptions, potentially achieving remote code execution and access to sensitive application data. Exploitation requires a high-privileged account and is triggered when the product description is rendered or previewed; publicly available exploit code exists, but the available data does not indicate confirmed active exploitation via CISA KEV. EPSS is low at 0.40% (33rd percentile), so priority should be driven by exposure of product-management accounts, and the vendor-released fix is Bagisto 2.3.8.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload feature allows a highly privileged admin-panel user to upload a file named with a .png extension whose contents are HTML/JavaScript; the backend's content sniffing then re-saves it as .html, so the script executes in the browser of any admin or editor who opens it, enabling session hijacking or unauthorized actions against those privileged accounts. Exploitation requires an authenticated account with upload/content privileges (PR:H) plus a victim who actively views the file (UI:R), so it is not remotely triggerable against a default, unattended installation; publicly available exploit code exists, EPSS is 0.28% (19th percentile), and there is no CISA KEV listing. The issue is fixed in Bagisto 2.3.8.
Stored cross-site scripting in Bagisto 2.3.7's admin 'Create New Customer' form lets an authenticated backend user inject JavaScript into the first_name and last_name fields, which is saved to the database and later executes when an admin or other viewer opens the customer record in a grid, listing, or detail view. Successful exploitation can steal session tokens or perform admin-level actions in the victim's browser, though it requires a second user to view the injected data (UI:R) and valid backend access to the create-customer form. Publicly available exploit code exists, but EPSS is 0.28% (19th percentile) and there is no CISA KEV confirmation; Bagisto 2.3.8 contains the vendor fix.
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in Webkul Bagisto 2.4.9 lets an authenticated backend user who holds only the settings.users.edit permission promote their own account to the Administrator role, gaining every admin-panel capability including store configuration, payment-gateway credentials and customer PII. Exploitation needs a valid low-privileged admin-panel credential but no user interaction and no non-default configuration; the admin.settings.users.update endpoint (UserController::update()) simply fails to verify who may grant a role, whether a user may change their own role, or whether the granted role's permissions are a subset of the actor's own. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.15% (5th percentile), but a successful self-promotion delivers full confidentiality, integrity and availability impact (CVSS 8.8, PR:L, no UI).
Arbitrary file read in Bagisto v2.4.1 allows unauthenticated remote attackers to retrieve sensitive files outside the web root by injecting path traversal sequences into the filename parameter of the ImageCacheController. The CVSS 4.0 base score of 8.7 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality impact, and no public exploit identified at time of analysis.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Improper privilege management in Bagisto's backend customer management endpoint allows authenticated low-privileged users to access customer behavior data beyond their authorization scope. The vulnerability affects all Bagisto releases from 2.4.0 through 2.4.4 at the /admin/customers endpoint via manipulation of the ID parameter. A publicly available proof-of-concept exploit exists on GitHub; the vendor has acknowledged the issue and confirmed partial internal remediation with remaining fixes planned for upcoming releases.
Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
RMA state validation in Webkul Bagisto 2.4.0-2.4.4 permits authenticated customers to bypass the intended Return Merchandise Authorization workflow by submitting crafted requests to /customer/account/rma/update-status, forcing unauthorized state transitions without merchant review. An authenticated customer can escalate an RMA to an approved or completed state outside the designed approval sequence, enabling potential fraudulent return processing. A public proof-of-concept exploit exists; the vendor has confirmed internal awareness and is addressing the issues in upcoming releases, though no specific patched version has been publicly confirmed.
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload/media-manager feature lets a back-office user with upload privileges plant an SVG containing embedded JavaScript that executes in another admin or editor's browser when the media is viewed. The vector is PR:H/UI:R (requires an authenticated privileged account and a victim who views the content), giving limited confidentiality and integrity impact within a changed scope. Public proof-of-concept detail accompanies the GitHub advisory and the vendor fixed the issue in 2.3.8; EPSS is low at roughly 0.28% and there is no CISA KEV entry, so this is a modest-severity, second-order XSS rather than a broadly exploited one.
CSV formula injection in Bagisto through 2.3.7 allows a user who can create or edit product data to store spreadsheet formulas in fields such as product name, which are then written unescaped into exported CSV files. When an administrator or other victim opens the export in Excel or similar software, the formula may be evaluated, enabling data exfiltration through functions such as WEBSERVICE or HYPERLINK and, in legacy or permissive spreadsheet environments, possible command execution. Publicly available exploit code exists, but exploitation requires a product-data write, a CSV export action, and a victim opening the file; there is no CISA KEV confirmation. The issue is fixed in 2.3.8.
Server-side template injection in Bagisto 2.3.7 lets an authenticated backend user with product-creation privileges inject Blade template expressions through product descriptions, potentially achieving remote code execution and access to sensitive application data. Exploitation requires a high-privileged account and is triggered when the product description is rendered or previewed; publicly available exploit code exists, but the available data does not indicate confirmed active exploitation via CISA KEV. EPSS is low at 0.40% (33rd percentile), so priority should be driven by exposure of product-management accounts, and the vendor-released fix is Bagisto 2.3.8.
Stored cross-site scripting in Bagisto 2.3.7's TinyMCE image-upload feature allows a highly privileged admin-panel user to upload a file named with a .png extension whose contents are HTML/JavaScript; the backend's content sniffing then re-saves it as .html, so the script executes in the browser of any admin or editor who opens it, enabling session hijacking or unauthorized actions against those privileged accounts. Exploitation requires an authenticated account with upload/content privileges (PR:H) plus a victim who actively views the file (UI:R), so it is not remotely triggerable against a default, unattended installation; publicly available exploit code exists, EPSS is 0.28% (19th percentile), and there is no CISA KEV listing. The issue is fixed in Bagisto 2.3.8.
Stored cross-site scripting in Bagisto 2.3.7's admin 'Create New Customer' form lets an authenticated backend user inject JavaScript into the first_name and last_name fields, which is saved to the database and later executes when an admin or other viewer opens the customer record in a grid, listing, or detail view. Successful exploitation can steal session tokens or perform admin-level actions in the victim's browser, though it requires a second user to view the injected data (UI:R) and valid backend access to the create-customer form. Publicly available exploit code exists, but EPSS is 0.28% (19th percentile) and there is no CISA KEV confirmation; Bagisto 2.3.8 contains the vendor fix.
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Bagisto 0.1.5 allows CSRF under /admin URIs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.