Composer bagisto/bagisto has 20 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-16403 | Authorization Bypass Through User-Controlled Key in Bagisto | high | 8.8 | <0.1.5 | 0.1.5 |
| CVE-2026-21450 | Bagisto SSTI vulnerability in type parameter can lead to RCE | high | 0.0 | <2.3.10 | 2.3.10 |
| CVE-2026-21448 | Bagisto has Normal & Blind SSTI from low-privilege user when ordering product | critical | 9.8 | <2.3.10 | 2.3.10 |
| CVE-2026-21446 | Bagisto Missing Authentication on Installer API Endpoints | critical | 9.8 | >=2.3.0 and <2.3.10 | 2.3.10 |
| CVE-2023-36236 | Cross-site Scripting in Bagisto | medium | 4.8 | <1.3.2 | 1.3.2 |
| CVE-2019-14933 | Bagisto CSRF Vulnerability | high | 8.8 | <0.1.5 | 0.1.5 |
| CVE-2026-21451 | Bagisto has HTML Filter Bypass that Enables Stored XSS | medium | 0.0 | <2.3.10 | 2.3.10 |
| CVE-2023-36238 | Bagisto vulnerable to Insecure Direct Object Reference (IDOR) | medium | 6.5 | <1.3.2 | 1.3.2 |
| CVE-2024-27499 | Bagist Cross-site Scripting vulnerability | medium | 6.5 | <2.1.0 | 2.1.0 |
| CVE-2026-21449 | Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users | high | 8.8 | <2.3.10 | 2.3.10 |
| CVE-2025-60880 | Bagisto is vulnerable to XSS through Admin Panel's product creation path | high | 8.3 | >=2.3.6 and <2.3.7 | 2.3.7 |
| CVE-2025-62416 | bagisto has Server Side Template Injection (SSTI) in Product Description | medium | 5.1 | <2.3.8 | 2.3.8 |
| CVE-2023-36237 | Bagisto Cross-Site Request Forgery vulnerability | high | 8.8 | <1.3.2 | 1.3.2 |
| CVE-2025-62417 | bagisto has CSV Formula Injection in Create New Product | critical | 9.0 | <2.3.8 | 2.3.8 |
| CVE-2026-21447 | Bagisto has IDOR in Customer Order Reorder Functionality | high | 7.1 | <2.3.10 | 2.3.10 |
| CVE-2025-62414 | bagisto has Cross Site Scripting (XSS) in Create New Customer | medium | 6.9 | <2.3.8 | 2.3.8 |
| CVE-2025-62415 | bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) | medium | 6.9 | <2.3.8 | 2.3.8 |
| CVE-2025-62418 | bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) | medium | 6.9 | <2.3.8 | 2.3.8 |
| CVE-2026-6744 | Bagisto affected by Server-Side Request Forgery | medium | 6.3 | <=2.3.15 | – |
| CVE-2026-6745 | Bagisto affected by Cross-site Scripting | low | 3.5 | <=2.3.15 | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked