Ek-Saini/security

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-36238 ↗	Mar 13, 2024Wednesday, 13 March 2024, 21:15	6.5 MEDIUM	—
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.
CVE-2024-27499 ↗	Mar 1, 2024Friday, 1 March 2024, 16:15	6.5 MEDIUM	—
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
CVE-2023-36237 ↗	Feb 26, 2024Monday, 26 February 2024, 22:15	8.8 HIGH	—
Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.
CVE-2023-36235 ↗	Jan 17, 2024Wednesday, 17 January 2024, 03:15	6.5 MEDIUM	—
An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.
CVE-2023-36236 ↗	Jan 16, 2024Tuesday, 16 January 2024, 22:15	4.8 MEDIUM	—
Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad.