CVE-2026-60120mediumCWE-79

CVE-2026-60120: falha de média gravidade em Webkul Bagisto

Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Bagisto

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.4%
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Webkul · Bagisto
CVEs relacionadas — Webkul Bagisto

No mesmo produto, das mais perigosas para as menos.

CVE-2026-9506HIGHPath Traversal Vulnerability in BagistoEPSS 1.4%CVE-2026-19835MEDIUMWebkul Bagisto Customer Item Deletion Endpoint access controlEPSS 0.5%CVE-2026-75082MEDIUMWebkul Bagisto Customer-Registration Notification Email register cross site scriptingEPSS 0.4%CVE-2026-19997MEDIUMWebkul Bagisto Backend Sales RMA Endpoint requests authorizationEPSS 0.4%CVE-2026-19834MEDIUMWebkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationEPSS 0.4%CVE-2026-19837MEDIUMWebkul Bagisto Customer Search search information disclosureEPSS 0.4%