CVE-2025-62414: falha de média gravidade em bagisto
bagisto - Cross Site Scripting (XSS) in Create New Customer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
bagisto · bagistoCVEs relacionadas — bagisto
No mesmo produto, das mais perigosas para as menos.
CVE-2026-21450HIGHBagisto has SSTI in parameter that can lead to RCEEPSS 1.4%CVE-2026-21448HIGHBagisto has Normal & Blind SSTI from low-privilege user when ordering productEPSS 0.9%CVE-2026-21446HIGHBagisto Missing Authentication on Installer API EndpointsEPSS 0.6%CVE-2026-21451MEDIUMBagisto has HTML Filter Bypass that Enables Stored XSSEPSS 0.6%CVE-2026-21449HIGHBagisto has SSTI via first and last name from low-privilege user (not admin)EPSS 0.5%CVE-2025-62416MEDIUMbagisto - Server Side Template Injection (SSTI) in Product DescriptionEPSS 0.4%