Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
References
| Link | Resource |
|---|---|
| https://github.com/Ek-Saini/security/blob/main/xss-bagisto-v1.5.1 | Exploit Third Party Advisory |
| https://github.com/auspicious7/Vulnerability-Discover/blob/main/CVE-2024-27499_bagisto-V-1.5.1 | |
| https://github.com/bagisto/bagisto/pull/9474 | Issue Tracking |
| https://github.com/Ek-Saini/security/blob/main/xss-bagisto-v1.5.1 | Exploit Third Party Advisory |
| https://github.com/bagisto/bagisto/pull/9474 | Issue Tracking |
Configurations
History
No history.
Information
Published : 2024-03-01 16:15
Updated : 2025-08-11 16:15
NVD link : CVE-2024-27499
Mitre link : CVE-2024-27499
CVE.ORG link : CVE-2024-27499
JSON object : View
Products Affected
webkul
- bagisto
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')