Known vulnerabilities in Bagisto

Software: Bagisto
Software CPE: cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*
Total vulnerabilities: 15
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Bagisto Bagisto is affected by 15 known vulnerabilities: 9 medium, 6 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127916 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-21451
CWE-80 Medium
No
No
2.3.10 25.04.2026 SB20260425207
#VU127914 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-21450
CWE-1336 Medium
No
No
2.3.10 25.04.2026 SB20260425207
#VU127912 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-21449
CWE-1336 Medium
No
No
2.3.10 25.04.2026 SB20260425207
#VU127910 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2026-21448
CWE-1336 Medium
No
No
2.3.10 25.04.2026 SB20260425207
#VU127909 - Authorization Bypass Through User-Controlled Key
CVE-2026-21447
CWE-639 Low
No
No
2.3.10 25.04.2026 SB20260425207
#VU127908 - Missing Authentication for Critical Function
CVE-2026-21446
CWE-306 Medium
No
No
2.3.10 25.04.2026 SB20260425207
#VU127907 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-62414
CWE-80 Low
No
No
2.3.8 25.04.2026 SB20260425206
#VU127906 - Improper Neutralization of Alternate XSS Syntax
CVE-2025-62418
CWE-87 Low
No
No
2.3.8 25.04.2026 SB20260425206
#VU127905 - Improper Neutralization of Formula Elements in a CSV File
CVE-2025-62417
CWE-1236 Low
No
No
2.3.8 25.04.2026 SB20260425206
#VU127904 - Improper Neutralization of Special Elements Used in a Template Engine
CVE-2025-62416
CWE-1336 Low
No
No
2.3.8 25.04.2026 SB20260425206
#VU127903 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-62415
CWE-80 Low
No
No
2.3.8 25.04.2026 SB20260425206
#VU58495 - Improper Control of Generation of Code ('Code Injection')
CWE-94 Medium
No
No
- 02.12.2021 SB2021120212
#VU50737 - Improper Access Control
CWE-284 Medium
No
No
1.3.0 16.02.2021 SB2021021615
#VU33983 - Missing Authorization
CVE-2019-16403
CWE-862 Medium
No
No
0.1.5 05.08.2020 SB2019091825
SB2019122640
#VU20040 - Cross-Site Request Forgery (CSRF)
CVE-2019-14933
CWE-352 Medium
No
No
0.1.6 12.08.2019 SB2019081202