MEDIUM🇵🇱 Wersja polska

CVE-2025-62414

CVSS 6.9v3.1pub. 2025-10-16upd. 2025-10-22

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

  • Webkul Bagisto

    APP
    Webkul
    2.3.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-21449HIGH7.4ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21446HIGH8.8ten sam produkt

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API route...

CVE-2026-21447HIGH7.1ten sam produkt

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Refer...

CVE-2026-21448HIGH8.9ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21450HIGH7.3ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...