HIGH🇬🇧 English

CVE-2026-21447

CVSS 7.1v3.1pub. 2026-01-02upd. 2026-01-08

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order ID parameter. This exposes sensitive purchase information and enables potential fraud. Version 2.3.10 patches the issue.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

  • Webkul Bagisto

    APP
    Webkul
    < 2.3.10
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
IDOR
CWE
Referencje

Powiązane podatności

CVE-2026-21450HIGH7.3ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21446HIGH8.8ten sam produkt

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API route...

CVE-2026-21448HIGH8.9ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2026-21449HIGH7.4ten sam produkt

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side t...

CVE-2025-62417HIGH7.1ten sam produkt

Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula...