Bagisto vulnerabilities
We track 7 vulnerabilities in Bagisto products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on January 2, 2026.
Latest Bagisto vulnerabilities
- 8.4 High severity
bagisto: Improper Neutralization of Input During Web Page Generation
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can
- 9.8 Critical severity
bagisto: Improper Neutralization of Special Elements Used in a Template Engine
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.
- 8.8 High severity
bagisto: Improper Neutralization of Special Elements Used in a Template Engine
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.
- 9.8 Critical severity
bagisto: Improper Neutralization of Special Elements Used in a Template Engine
Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can le
- 7.1 High severity
bagisto: Improper Access Control
Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own sh
- 9.8 Critical severity
bagisto: Missing Authentication for Critical Functionality
Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable w
- 7.8 High severity
bagisto: Improper Neutralization of Formula Elements in a CSV File
Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will int