Webkul Bagisto vulnerabilities

An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/sales/rma/requests (Backend Sales RMA Endpoint). Manipulation allows remote authorization bypass. The exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/customers (Backend Customer Behavior Data Endpoint). Manipulation of the ID argument leads to improper privilege management. The attack can be executed remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

Cross-site scripting vulnerability in Webkul Bagisto up to 2.4.4, in the file /customer/account/rma/send-message of the RMA Message Handler component. Manipulation of the Message argument allows remote script execution in the browser. The exploit has been publicly disclosed.

An authorization bypass vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /admin/configuration/cache-management/execute (Configuration Management). Manipulation of the action argument leads to authorization bypass. The attack may be launched remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A vulnerability has been detected in Webkul Bagisto up to version 2.4.4 in file /customer/account/rma/update-status (RMA State Validation). Manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues have already been addressed, and the rest are planned for upcoming releases.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. The issue affects unknown code in /admin/reporting/sales/ of the Backend Reporting Endpoint, leading to authorization bypass. Remote exploitation is possible, and the exploit is publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A weakness has been identified in Webkul Bagisto up to 2.4.4 in the file /admin/customers/search of the Customer Search component. Manipulating the Query argument can lead to information disclosure. The attack can be launched remotely, and the exploit is publicly available. The vendor confirms that the issues are already known and partially addressed.

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. The issue affects unknown functionality in /admin/customers/view of the Backend Customer Detail Feature. Manipulation of the ID argument results in authorization bypass. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A vulnerability was identified in Webkul Bagisto up to 2.4.4 in the Customer Item Deletion Endpoint component. The manipulation leads to improper access controls. The attack can be launched remotely, and the exploit is publicly available. The vendor confirms that the issues are already known and partially addressed.

A vulnerability was determined in Webkul Bagisto up to 2.4.4. The issue affects an unknown function in /admin/customers/login-as-customer/ of the Admin Customer Impersonation Feature. Manipulation of the ID argument causes authorization bypass. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.