Threats tagged 'ghsa-j38w-r3vf-5255'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Low	2.1	CVE-2026-121733Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to Low2.12026-11-04GCVE DatabaseCVE-2026-121733 Bagisto versions before 2.4.5 have a stored cross-site scripting (XSS) vulnerability in the RMA send-message endpoint. Authenticated customers can upload HTML files without validation of type or extension. These files, containing malicious JavaScript, are served under /storage/rma-conversation/. When an administrator opens such a file, the script executes in the context of the shop's origin. Report on CVE-2026-121733 Vulnerability CWE-434 #ghsa-j38w-r3vf-5255	GCVE Database	2026-11-04

Page 1 of 1