CVE-2026-21451
CVE-2026-21451 · Bagisto has HTML Filter Bypass that Enables Stored XSS
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.
CVSS 5.2 · Mittel · EPSS 0,6% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
bagisto
- Softwareversionen
- < 2.3.10: Betroffen
Keine Korrektur veröffentlicht
bagisto/bagisto Packagist
- Softwareversionen
- v0.1.0
- v0.1.1
- v0.1.2
- v0.1.3
- v0.1.4
- v0.1.4-BETA1
- v0.1.4-BETA2
- v0.1.4-BETA3
- v0.1.4-BETA4
- v0.1.5
- v0.1.6
- v0.1.6-ALPHA1
- v0.1.7
- v0.1.7-BETA1
- v0.1.7-BETA2
- v0.1.8
- v0.1.9
- v0.1.9-BETA1
- v0.2.0
- v0.2.1
- v0.2.2
- v1.0.0
- v1.0.0-BETA1
- v1.1.0
- v1.1.1
- v1.1.2
- v1.2.0
- v1.2.0-BETA1
- v1.3.0
- v1.3.1
- v1.3.2
- v1.3.3
- v1.4.0
- v1.4.1
- v1.4.2
- v1.4.3
- v1.4.4
- v1.4.5
- v1.5.0
- v1.5.1
- v2.0.0
- v2.0.0-BETA-1
- v2.1.0
- v2.1.1
- v2.1.2
- v2.2.0
- v2.2.1
- v2.2.10
- v2.2.2
- v2.2.3
- v2.2.4
- v2.2.5
- v2.2.6
- v2.2.7
- v2.2.8
- v2.2.9
- v2.3.0
- v2.3.1
- v2.3.2
- v2.3.3
- v2.3.4
- v2.3.5
- v2.3.6
- v2.3.7
- v2.3.8
- v2.3.9
- Betroffene Versionsbereiche
- ECOSYSTEM: < 2.3.10
Auf 2.3.10 aktualisieren