CVE-2026-121733lowCWE-434

CVE-2026-121733: falha de baixa gravidade em Webkul Bagisto

Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Bagisto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.1epss 0.2%
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Webkul · Bagisto
CVEs relacionadas — Webkul Bagisto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-9506HIGHPath Traversal Vulnerability in BagistoEPSS 1.4%CVE-2026-19835MEDIUMWebkul Bagisto Customer Item Deletion Endpoint access controlEPSS 0.5%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-19997MEDIUMWebkul Bagisto Backend Sales RMA Endpoint requests authorizationEPSS 0.4%CVE-2026-19834MEDIUMWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationEPSS 0.4%CVE-2026-19837MEDIUMWebkul Bagisto Customer Search search information disclosureEPSS 0.4%