GHSA-65fp-7g2v-658r

Suggest an improvement
Source
https://github.com/advisories/GHSA-65fp-7g2v-658r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-65fp-7g2v-658r/GHSA-65fp-7g2v-658r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-65fp-7g2v-658r
Aliases
  • CVE-2026-6745
Published
2026-04-21T21:31:23Z
Modified
2026-05-06T22:26:26Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Bagisto affected by Cross-site Scripting
Details

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T22:07:13Z",
    "nvd_published_at": "2026-04-21T19:16:18Z",
    "severity": "LOW"
}
References

Affected packages

Packagist / bagisto/bagisto

Package

Name
bagisto/bagisto
Purl
pkg:composer/bagisto/bagisto

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.3.15

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4-BETA1
v0.1.4-BETA2
v0.1.4-BETA3
v0.1.4-BETA4
v0.1.4
v0.1.5
v0.1.6-ALPHA1
v0.1.6
v0.1.7-BETA1
v0.1.7-BETA2
v0.1.7
v0.1.8
v0.1.9-BETA1
v0.1.9
v0.2.0
v0.2.1
v0.2.2
v1.*
v1.0.0-BETA1
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0-BETA1
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.1
v2.*
v2.0.0-BETA-1
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.2.10
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-65fp-7g2v-658r/GHSA-65fp-7g2v-658r.json"