CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2026-21451

Bagisto Stored XSS: When the CMS Becomes a Skimmer's Paradise

Amit Schendel
Amit Schendel
Senior Security Researcher

Jan 2, 2026·6 min read·27 visits

Executive Summary (TL;DR)

Bagisto versions prior to 2.3.10 fail to sanitize HTML input on the server side within the CMS page editor. Developers relied on the WYSIWYG editor's client-side filtering, which can be trivially bypassed using a proxy. An attacker with CMS permissions can inject persistent JavaScript that executes for all visitors, leading to potential credit card skimming or session hijacking.

A classic 'client-side trust' failure in the Bagisto e-commerce platform allows privileged attackers to bypass HTML filters and inject malicious JavaScript. While requiring administrative access, this Stored XSS vulnerability poses a severe threat to storefront customers, enabling Magecart-style skimming attacks via the CMS page editor.

Official Patches

BagistoBagisto v2.3.10 Release Notes
BagistoPull Request #11068 - Fix sanitize cms content xss

Fix Analysis (1)

Technical Appendix

CVSS Score
5.2/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P

Affected Systems

Bagisto eCommerce PlatformLaravel Applications using vulnerable Bagisto packages

Affected Versions Detail

Product
Affected Versions
Fixed Version
Bagisto
Webkul
< 2.3.102.3.10
AttributeDetail
CWE IDCWE-79
CVSS v4.05.2 (Medium)
Attack VectorNetwork (Authenticated)
Privileges RequiredHigh (Admin)
ImpactStored XSS / Data Exfiltration
Fix Version2.3.10

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1550.002Use Alternate Authentication Material: Pass the Hash
Defense Evasion
CWE-79
Cross-site Scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Known Exploits & Detection

GitHub AdvisoryOfficial advisory containing reproduction steps

Vulnerability Timeline

Fix committed to repository
2025-12-24
CVE-2026-21451 Published
2026-01-02
Bagisto v2.3.10 Released
2026-01-02

References & Sources

  • [1]GHSA-2mwc-h2mg-v6p8: Stored XSS in Bagisto
  • [2]Bagisto Official Site
Related Vulnerabilities
CVE-2026-21446CVE-2026-21447CVE-2026-21448

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•1 day ago•CVE-2026-11748
6.9

CVE-2026-11748: Unauthenticated LDAP Injection in Central Dogma Server Authentication

An LDAP injection vulnerability exists in the centraldogma-server-auth-shiro module of LY Corporation Central Dogma before version 0.84.0. The search logic dynamically constructs LDAP search filters by interpolating user-provided usernames without escaping RFC 4515 metacharacters. Unauthenticated remote attackers can leverage this flaw to bypass authentication, enumerate directory hierarchies, and access unauthorized resources.

Alon Barad
Alon Barad
9 views•6 min read
•1 day ago•CVE-2026-11746
9.4

CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server

CVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.

Amit Schendel
Amit Schendel
7 views•6 min read
•1 day ago•CVE-2026-56665
4.2

CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider

A logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.

Alon Barad
Alon Barad
7 views•7 min read
•1 day ago•CVE-2026-59149
6.5

CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server

CVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.

Amit Schendel
Amit Schendel
9 views•5 min read
•1 day ago•CVE-2026-59148
8.8

CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon

An in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.

Alon Barad
Alon Barad
11 views•6 min read
•1 day ago•CVE-2026-56666
4.8

CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler

An improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.

Amit Schendel
Amit Schendel
7 views•7 min read