Product by Webkul

    Webkul Bagisto

    37 known vulnerabilities in Webkul Bagisto (Webkul), 0 of them actively exploited (CISA KEV).

    Key figures

    37

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Webkul Bagisto (Webkul)
    HighCVE-2026-9506

    Path Traversal Vulnerability in Bagisto

    		—
    CriticalCVE-2026-21450

    Bagisto has SSTI in parameter that can lead to RCE

    also in 1 other product

    		9.8
    CriticalCVE-2026-21448

    Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

    also in 1 other product

    		9.8
    HighCVE-2019-16403

    Webkul Bagisto: security vulnerability

    		8.8
    CriticalCVE-2026-21446

    Bagisto Missing Authentication on Installer API Endpoints

    also in 1 other product

    		9.8
    HighCVE-2023-33570

    Webkul Bagisto: Template Injection

    		8.8
    HighCVE-2026-21451

    Bagisto has HTML Filter Bypass that Enables Stored XSS

    also in 1 other product

    		8.4
    HighCVE-2026-21449

    Bagisto has SSTI via first and last name from low-privilege user (not admin)

    also in 1 other product

    		8.8
    MediumCVE-2026-19994

    Webkul Bagisto Configuration Management execute authorization

    		6.3
    HighCVE-2019-14933

    Webkul Bagisto: Cross-Site Request Forgery (CSRF)

    		8.8
    HighCVE-2025-60880

    Webkul Bagisto: Cross-Site Scripting (XSS)

    		8.3
    MediumCVE-2026-19835

    Webkul Bagisto Customer Item Deletion Endpoint access control

    		3.8
    MediumCVE-2026-19997

    Webkul Bagisto Backend Sales RMA Endpoint requests authorization

    		4.7
    MediumCVE-2026-19834

    Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

    		4.7
    HighCVE-2025-62417

    bagisto - CSV Formula Injection in Create New Product

    also in 1 other product

    		7.8
    MediumCVE-2026-19838

    Webkul Bagisto Backend Reporting Endpoint sales authorization

    		4.3
    MediumCVE-2026-19836

    Webkul Bagisto Backend Customer Detail Feature view authorization

    		4.3
    MediumCVE-2026-101139

    Webkul Bagisto Invoice Mass Status Update state authorization

    		2.7
    MediumCVE-2026-19837

    Webkul Bagisto Customer Search search information disclosure

    		2.7
    MediumCVE-2026-19996

    Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management

    		4.3
    HighCVE-2023-36237

    Webkul Bagisto: Cross-Site Request Forgery (CSRF)

    		8.8
    MediumCVE-2026-121733

    Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

    		5.4
    MediumCVE-2026-19993

    Webkul Bagisto RMA State Validation update-status behavioral workflow

    		4.3
    MediumCVE-2026-75082

    Webkul Bagisto Customer-Registration Notification Email register cross site scripting

    		4.3
    MediumCVE-2026-19995

    Webkul Bagisto RMA Message send-message cross site scripting

    		3.5

    All vulnerabilities in search

    All products by Webkul