BBagisto

Products

Exploited and recent CVEs

• CVE-2026-121628 Low 3.7 Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting 0.3%
• CVE-2026-21450 High 7.3 Bagisto has SSTI in parameter that can lead to RCE 1.4%
• CVE-2026-21451 Medium 5.2 Bagisto has HTML Filter Bypass that Enables Stored XSS 0.6%
• CVE-2026-21449 High 7.4 Bagisto has SSTI via first and last name from low-privilege user (not admin) 0.5%
• CVE-2026-21448 High 8.9 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product 0.9%
• CVE-2026-21447 High 7.1 Bagisto has IDOR in Customer Order Reorder Functionality 0.3%
• CVE-2026-21446 High 8.8 Bagisto Missing Authentication on Installer API Endpoints 0.6%
• CVE-2025-62415 Medium 6.9 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) 0.3%
• CVE-2025-62418 Medium 6.9 bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) 0.3%
• CVE-2025-62414 Medium 6.9 bagisto - Cross Site Scripting (XSS) in Create New Customer 0.3%
• CVE-2025-62416 Medium 5.1 bagisto - Server Side Template Injection (SSTI) in Product Description 0.4%
• CVE-2025-62417 High 7.1 bagisto - CSV Formula Injection in Create New Product 0.4%
• CVE-2025-40675 Medium 5.1 Reflected Cross-Site Scripting (XSS) in Bagisto 0.2%