CVE-2026-60120
- Source
- https://cve.org/CVERecord?id=CVE-2026-60120
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-60120.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-60120
- Published
- 2026-07-09T20:43:07Z
- Modified
- 2026-11-04T02:47:46Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
- Details
-
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60120.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60120.json
- https://github.com/bagisto/bagisto/releases/tag/v2.4.4
- https://nvd.nist.gov/vuln/detail/CVE-2026-60120
- https://www.vulncheck.com/advisories/bagisto-stored-xss-via-csti-in-create-blade-php
- https://github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97
- https://github.com/bagisto/bagisto
Affected packages
Git / github.com/bagisto/bagisto
Affected ranges
- Type
- GIT
- Repo
- https://github.com/bagisto/bagisto
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "2.4.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "original_tag": "v2.4.4", "range": [ { "fixed": "681cc121b5ef206ced824667506e02d47c92af95" } ], "source": "REFERENCES_TAG" }, { "range": [ { "fixed": "49d0c3fc90dedf8782c45c5979df4f4595d6bb97" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
1.*
1.4.0
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.4-BETA1
v0.1.4-BETA2
v0.1.4-BETA3
v0.1.4-BETA4
v0.1.5
v0.1.6-ALPHA1
v0.1.7
v0.1.8
v1.*
v1.0.0
v1.0.0-BETA1
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.0-BETA1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v2.*
v2.0.0
v2.0.0-BETA-1
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.0-beta1
v2.4.0-beta2
v2.4.0-beta3
v2.4.0-beta4
v2.4.0-beta5
v2.4.0-beta6
v2.4.1
v2.4.2